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PART 1, Predefined symbols 



All the predefined symbols can be used in both MASM and Ideal mode. 

$ 

Represents the current location counter within the current segment. 
_____ 

Numeric equate indicating whether segments in the current model are de- 
clared as 16 bit or 32 bit. 

©code 

Alias equate for .CODE segment name. 

©CodeSize 

Numeric equate that indicates code memory model (0=near, l=far). 

@CPU 

Numeric equate that returns information about current processor direc- 
tive. 

@curseg 

Alias equate for current segment. 

@data 

Alias equate for near data group name. 

@DataSize 

Numeric equate that indicates the data memory model (0=near, l=far, 

2=huge). 

_____ 

String equate for today's date. 

@fardata 

Alias equate for initialized far data segment name. 

@fardata? 

Alias equate for uninitialized far data segment name. 

@FileName 

Alias equate for current assembly file name. 
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??filename 



??filename 

String equate for current assembly file name. 



©Interface 

Numeric equate indicating the language and operating system selected 
by MODEL. 

©Model 

Numeric equate representing the model currently in effect. 

©Object 

Text macro containing the name of the current object. 
= Alias equate for stack segment. 

©Stack 

Alias equate for stack segment. 

©Startup 

Label that marks the beginning of startup code. 

@10h\e_<objectname> 

Data type containing the object's method table. 

@TableAddr_<ob/ec£name> 

Label describing the address of the instance of the object's virtual method 
table. 

??time 

String equate for the current time. 

??version 

Numeric equate for current Turbo Assembler version number. 

©WordSize 

Numeric equate that indicates 16- or 32-bit segments (2=16-bit, 4=32-bit). 
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Operators 



PART 2, Operators 



This part covers the operators Turbo Assembler provides and their 
precedence. The two tables that follow detail operator precedence for 
Ideal and MASM modes. 



Ideal mode operator precedence 

The following table lists the operators in order of priority (highest is first, 
lowest is last): 

■ (), [], LENGTH, MASK, OFFSET, SEG, SIZE, WIDTH 

■ HIGH, LOW 

■ +, - (unary) 

■ *, /, MOD, SHL, SHR 

■ +, - (binary) 

■ EQ, GE, GT, LE, LT, NE 

■ NOT 

■ AND 

■ OR, XOR 

■ : (segment override) 

■ . (structure member selector) 

■ HIGH (before pointer), LARGE, LOW (before pointer), PTR, SHORT, 
SMALL, SYMTYPE 

MASM mode operator precedence 

■ <, (), [], LENGTH, MASK, SIZE, WIDTH 

■ . (structure member selector) 

■ HIGH, LOW 

■ +, - (unary) 

■ : (segment override) 

■ OFFSET, PTR, SEG, THIS, TYPE 

■ *, /, MOD, SHL, SHR 

■ +, - (binary) 

■ EQ, GE, GT, LE, LT, NE 

■ NOT 

■ AND 

■ OR, XOR 

■ LARGE, SHORT, SMALL, .TYPE 
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(> 



Operators 



() 

(expression) 
Marks expression for priority evaluation. 



Ideal, MASM 



Ideal, MASM 



expressionl * expression! 

Multiplies two integer expressions. Also used with 80386 addressing 
modes where one expression is a register. 



+ (binary) 

expressionl + expression! 
Adds two expressions. 



Ideal, MASM 



+ (unary) 

+• expression 
Indicates that expression is positive. 



Ideal, MASM 



- (binary) 

expressionl - expressionl 
Subtracts two expressions. 



Ideal, MASM 



- (unary) 

- expression 
Changes the sign of expression. 



Ideal, MASM 



memptr, .fieldname 
Selects a structure member. 



Ideal, MASM 



/ 

expressionl / expressionl 
Divides two integer expressions. 



Ideal, MASM 
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Ideal, MASM 



segorgroup : expression- 
Generates segment or group override. 



Ideal, MASM 



Dx? 



Initializes with indeterminate data (where Dx is DB, DD, DF, DP, DQ, 
DT,orDW). 

( ) Ideal, MASM 

expressionl[expression2] 

[expressionl][expression2] 

MASM mode: The [ ] operator can be used to specify addition or register 
indirect memory operands. 

Ideal mode: The [ ] operator specifies a memory reference. 

AND Ideal, MASM 

expressionl AND expression! 
Performs a bit-by-bit logical AND of two expressions. 



BYTE 

BYTE expression 
Forces address expression to be byte size. 



Ideal 



BYTE PTR 

BYTE PTR expression 
Forces address expression to be byte size. 



Ideal, MASM 



CODEFTR 

CODEPTR expression 
Returns the default procedure address size. 



DUP 

count UUP {expression [expression]...) 
Repeats a data allocation operation count times. 



Ideal, MASM 



DATAPTR Ideal 

DAT APTR expression 
Forces address expression to model-dependent size. 



Ideal, MASM 
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DWORD 

DWORD ideal 

DWORD expression 
Forces address expression to be doubleword size. 

DWORD PTR Ideal, MASM 

DWORD PTR expression 
Forces address expression to be doubleword size. 

EQ Ideal, MASM 

expressionl EQ expression! 
Returns true if expressions are equal. 

FAR Ideal 

FAR expression 
Forces an address expression to be a far code pointer. 

FAR PTR Ideal, MASM 

FAR PTR expression 
Forces an address expression to be a far code pointer. 

FWORD ide^i 

FWORD expression 

Forces address expression to be 32-bit far pointer size. 

FWORD PTR Ideal, MASM 

FWORD PTR expression 
Forces address expression to be 32-bit far pointer size. 

GE Ideal, MASM 

expressionl GE expressionl 
Returns true if one expression is greater than or equal to the other. 

GT Ideal, MASM 

expressionl GT expression! 
Returns true if one expression is greater than the other. 

HIGH Ideal, MASM 

HIGH expression 
Returns the high part (8 bits or type size) of expression. 
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HIGH 



HIGH Ideal 

type HIGH expression 
Returns the high part (8 bits or type size) of expression. 

LARGE Ideal, MASM 

LARGE expression 

Sets expression's offset size to 32 bits. In Ideal mode, this operation is legal 
only if 386 code generation is enabled. 

LE Ideal, MASM 

expressionl LE expression! 
Returns true if one expression is less than or equal to the other. 

LENGTH Ideal, MASM 

LENGTH name 
Returns number of data elements allocated as part of name. 

LOW Ideal, MASM 

LOW expression 
Returns the low part (8 bits or type size) of expression. 

LOW Ideal 

type LOW expression 
Returns the low part (8 bits or type size) of expression. 

LT Ideal, MASM 

expressionl LT expressionl 
Returns true if one expression is less than the other. 



MASK 



Ideal, MASM 



MASK recordfieldname 
MASK record 

Returns a bit mask for a record field or an entire record. 

MOD Ideal, MASM 

expressionl MOD expression! 
Returns remainder (modulus) from dividing two expressions. 



10 
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NE 

expressionl NE expression! 
Returns true if expressions are not equal. 



NE 



Ideal, MASM 



NEAR Ideal 

NEAR expression 

Forces an address expression to be a near code pointer. 

NEAR PTR Ideal, MASM 

NEAR PTR expression 
Forces an address expression to be a near code pointer. 

NOT Ideal, MASM 

NOT expression 
Performs a bit-by-bit complement (invert) of expression. 

OFFSET Ideal, MASM 

OFFSET expression 

Returns the offset of expression within the current segment (or the group 
that the segment belongs to, if using simplified segmentation directives 
or Ideal mode). 

OR Ideal, MASM 

expressionl OR expression! 
Performs a bit-by-bit logical OR of two expressions. 

PROC Ideal 

PROC expression 
Forces an address expression to be a near or far code pointer. 

PROC PTR Ideal, MASM 

PROC PTR expression 
Forces an address expression to be a near or far code pointer. 

PTR Ideal, MASM 

type PTR express ion 
Forces address expression to have type size. 
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PWORD 

PWORD Ideal 

PWORD expression- 
Forces address expression to be 32-bit far pointer size. 

PWORD PTR Ideal, MASM 

PWORD PTR expression 
Forces address expression to be 32-bit far pointer size. 

QWORD Ideal 

QWORD expression 
Forces address expression to be quadword size. 

QWORD PTR Ideal, MASM 

QWORD PTR expression 
Forces address expression to be quadword size. 

SEG Ideal, MASM 

SEG expression 
Returns the segment address of an expression that references memory. 

SHL Ideal, MASM 

expression SHL count 

Shifts the value of expression to the left count bits. A negative count causes 
the data to be shifted the opposite way. 

SHORT Ideal, MASM 

SHORT expression 

Forces expression to be a short code pointer (within -128 to +127 bytes of 
the current code location). 

SHR Ideal, MASM 

expression SHR count 

Shifts the value of expression to the right count bits. A negative count 
causes the data to be shifted the opposite way. 

SIZE Ideal, MASM 

SIZE name 

Returns size of data item allocated with name. In MASM mode, SIZE re- 
turns the value of LENGTH name multiplied by TYPE name. In Ideal 
mode, SIZE returns the byte count within name's DUP. 
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SMALL 



SMALL Ideal, MASM 

SMALL expression 
Sets expression's offset size to 16 bits. In Ideal mode, this operation is legal 



only if 386 code generation is enabled. 



SYMTYPE Ideal 

SYMTYPE 
Returns a byte describing expression. 

TBYTE Ideal 

TBYTE expression 
Forces address expression to be 10-byte size. 

TBYTE PTR Ideal, MASM 

TBYTE PTR expression 
Forces address expression to be 10-byte size. 

THIS Ideal, MASM 

THIS type 

Creates an operand whose address is the current segment and location 
counter, type describes the size of the operand and whether it refers to 
code or data. 

.TYPE MASM 

.TYPE expression 
Returns a byte describing the mode and scope of expression. 

TYPE IDEAL 

TYPE namel name! 

Applies the type of an existing variable or structure member to another 
variable or structure member. 

TYPE MASM 

TYPE expression 
Returns a number indicating the size or type of expression. 

UNKNOWN Ideal 

UNKNOWN expression 
Removes type information from address expression. 
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WIDTH Ideal, MASM 

WIDTH recordfieldname 
WIDTH record 

Returns the width in bits of a field in a record, or of an entire record. 

WORD Ideal 

WORD expression 
Forces address expression to be word size. 

WORD PTR Ideal, MASM 

WORD PTR expression 
Forces address expression to be word size. 

XOR Ideal, MASM 

expressionl XOR expression! 

Performs bit-by-bit logical exclusive OR of two expressions. 
Unconditional page break inserted for print formatting 

The special macro operators 

& Ideal, MASM 

tkname 
Substitutes actual value of macro parameter name. 

<> Ideal, MASM 

Treats text literally, regardless of any special characters it might contain. 

! Ideal, MASM 

[character 

Treats character literally, regardless of any special meaning it might other- 
wise have. 

% Ideal, MASM 

%text 

Treats text as an expression, computes its value and replaces text with the 
result, text may be either a numeric expression or a text equate. 

;; Ideal, MASM 

;;comment 

Suppresses storage of a comment in a macro definition. 
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.186 



.186 MASM 

Enables assembly of 80186 processor instructions. 

.286 MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

.286C MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

.286P MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

.287 MASM 

Enables assembly of 80287 numeric coprocessor instructions. 

.386 MASM 

Enables assembly of non-privileged (real mode) 386 processor instruc- 
tions and 387 numeric coprocessor instructions. 

.386C MASM 

Enables assembly of non-privileged (real mode) 386 processor instruc- 
tions and 387 numeric coprocessor instructions. 

.386P MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 

.387 MASM 

Enables assembly of 387 numeric coprocessor instructions. 

.486 MASM 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 

.486C MASM 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 

.486P MASM 

Enables assembly of protected mode instructions for the 80486 processor. 
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.487 



.487 MASM 

Enables assembly of 487 numeric processor instructions. 

.586 MASM 

Enables assembly of non-privileged (real mode) instructions for the 
Pentium processor. 

.586C MASM 

Enables assembly of non-privileged (real mode) instructions for the 
Pentium processor. 

.586P MASM 

Enables assembly of protected mode instructions for the Pentium proces- 
sor. 

.587 MASM 

Enables assembly of Pentium numeric processor instructions. 

.8086 MASM 

Enables assembly of 8086 processor instructions only. This is the default 
processor instruction mode used by Turbo Assembler. 

.8087 MASM 

Enables assembly of 8087 numeric coprocessor instructions only. This is 
the default coprocessor instruction mode used by Turbo Assembler. 

: Ideal, MASM 

name: 
Defines a near code label called name. 

= Ideal, MASM 

name = expression 
Defines or redefines a numeric equate. 

ALIGN Ideal, MASM 

ALIGN boundary 

Rounds up the location counter to a power-of-two address boundary (2, 
4, 8, ...). 

.ALPHA masm 

Sets alphanumeric segment-ordering. The /a command-line option per- 
forms the same function. 
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ALIAS 



ALIAS Ideal, MASM 

ALIAS <alias_name>=<target_name> 

Allows the association of an alias name with a particular target name. 
When the linker encounters an alias name, it resolves the alias by refer- 
ring to the target name. 

NOTE: The syntax for ALIAS is identical in both Ideal and MASM modes. 

ARG Ideal, MASM 

ARG argument [argument] ... [=symbol] 
[RETURNS argument [argument]] 

Sets up arguments on the stack for procedures. Each argument is as- 
signed a positive offset from the BP register, presuming that both the re- 
turn address of the procedure call and the caller's BP have been pushed 
onto the stack already. Each argument has the following syntax (boldface 
items are literal): 

argname [[countl]] [:[debug_size] [type] [:count2]] 

The optional debug_size has this syntax: 

[type]VTR 

ASSUME Ideal, MASM 



ASSUME segmentreg-.name [,segmentreg:name\... 
ASSUME segmentreg-NOTHJN'G 
ASSUME NOTHING 



Specifies the segment register (segmentreg) that will be used to calculate 
the effective addresses for all labels and variables defined under a given 
segment or group name (name). The NOTHING keyword cancels the as- 
sociation between the designated segment register and segment or group 
name. The ASSUME NOTHING statement removes all associations be- 
tween segment registers and segment or group names. 

%BIN Ideal, MASM 

%BIN size 
Sets the width of the object code field in the listing file to size columns. 

CALL Ideal, MASM 

CALL<instance^tr>METHOD{object_name>:} 
<method_name>{USES{segreg:}ojfsreg}{<extended_call_parameters>} 

Calls a method procedure. 

CATSTR Ideal, MASM51 

name CATSTR string [,string\... 
Concatenates several strings to form a single string name. 
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.CODE MASM 

Same as CODESEG. MASM mode only. 

CODESEG Ideal, MASM 

CODESEG [name] 

Defines the start of a code segment when used with the .MODEL direc- 
tive. If you have specified the medium or large memory model, you can 
follow the .CODE (or CODESEG) directive with an optional name that 
indicates the name of the segment. 

CO MM Ideal, MASM 

COMM definition ^definition]... 

Defines a communal variable. Each definition describes a symbol and has 
the following format (boldface items are literal): 

[distance] [language] symbolname[ [ countl ] ]:type [:count2] 

distance can be either NEAR or FAR and defaults to the size of the de- 
fault data memory model if not specified, language is either C, PASCAL, 
BASIC, FORTRAN, PROLOG, or NOLANGUAGE and defines any lan- 
guage-specific conventions to be applied to symbolname. symbolname is the 
communal symbol (or symbols, separated by commas). If distance is 
NEAR, the linker uses countl to calculate the total size of the array. If dis- 
tance is FAR, the linker uses countl to indicate how many elements there 
are of size countl times the basic element size (determined by type), type 
can be one of the following: BYTE, WORD, DATAPTR, CODEPTR, 
DWORD, FWORD, PWORD, QWORD, TBYTE, or a structure name. 
countl specifies how many items this communal symbol defines. Both 
countl and countl default to 1. 

COMMENT masm 

COMMENT delimiter [text] 

[text] 

delimiter [text] 

Starts a multiline comment, delimiter is the first non-blank character fol- 
lowing COMMENT. 

%COND Ideal, MASM 

Shows all statements in conditional blocks in the listing. This is the de- 
fault mode for Turbo Assembler. 

.CONST MASM 

Same as CONST. MASM mode only. 

CONST Ideal, MASM 

Defines the start of the constant data segment. 
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.CREF MASM 

Same as %CREF. MASM mode only. 

%CREF Ideal, MASM 

Allows cross-reference information to be accumulated for all symbols en- 
countered from this point forward in the source file. .CREF reverses the 
effect of any %XCREF or .XCREF directives that inhibited the informa- 
tion collection. 

%CREFALL Ideal, MASM 

Causes all subsequent symbols in the source file to appear in the 
cross-reference listing. This is the default mode for Turbo Assembler. 
%CREFALL reverses the effect of any previous %CREFREF or 
%CREFUREF directives that disabled the listing of unreferenced 
or referenced symbols. 

%CREFREF Ideal, MASM 

Disables listing of unreferenced symbols in cross-reference. 

%CREFUREF ideal, masm 

Lists only the unreferenced symbols in cross-reference. 

%CTLS Ideal, MASM 

Causes listing control directives (such as %LIST, %INCL, and so on) to 
be placed in the listing file. , 

.DATA masm 

Same as DATASE6. MASM mode only. 

DATASEG Ideal 

Defines the start of the initialized data segment in your module. You 
must first have used the .MODEL directive to specify a memory model. 
The data segment is put in a group called DGROUP, which also contains 
the segments defined with the .STACK, .CONST, and .DATA? directives. 

.DATA? masm 

Defines the start of the uninitialized data segment in your module. You 
must first have used the .MODEL directive to specify a memory model. 
The data segment is put in a group called DGROUP, which also contains 
the segments defined with the .STACK, .CONST, and .DATA directives. 
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DB Ideal, MASM 

[name] DB expression [expression]... 

Allocates and initializes a byte of storage, name is the symbol you'll subse- 
quently use to refer to the data, expression can be a constant expression, a 
question mark, a character string, or a DUPlicated expression. 

DD Ideal, MASM 

[name] DD [type PTR] expression [expression]... 

Allocates and initializes 4 bytes (a doubleword) of storage, name is the 
symbol you'll subsequently use to refer to the data, type followed by 
PTR adds debug information to the symbol being defined, so that Turbo 
Debugger can display its contents properly, type is one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a 32-bit floating-point number, a question 
mark, an address expression, or a DUPlicated expression. 

%DEPTH Ideal, MASM 

%DEPTH width 

Sets size of depth field in listing file to width columns. The default is 1 col- 
umn. 

DF Ideal, MASM 

[name] DF [type PTR] expression [expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is 
the symbol you'll subsequently use to refer to the data, type followed by 
PTR adds debug information to the symbol being defined, so that Turbo 
Debugger can display its contents properly, type is one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a question mark, an address expression, or 
a DUPlicated expression. 

DISPLAY Ideal, MASM 

DISPLAY "text" 
Outputs a quoted string (text) to the screen. 

DOSSEG Ideal, MASM 

Enables DOS segment-ordering at link time. DOSSEG is included for 
backward compatibility only. 



PART 3, Directives 21 



DP 



DP Ideal, MASM 

[name] DP [type PTR] expression [expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is 
the symbol you'll subsequently use to refer to the data, type followed by 
PTR adds debug information to the symbpl being defined, so that Turbo 
Debugger can display its contents properly, type is one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a question mark, an address expression, or 
a DUPlicated expression. 

DQ Ideal, MASM 

[name] DQ expression [expression]... 

Allocates and initializes 8 bytes (a quadword) of storage, name is the sym- 
bol you'll subsequently use to refer to the data, expression can be a con- 
stant expression, a 64-bit floating-point number, a question mark, or a 
DUPlicated expression. 

DT Ideal, MASM 

[name] DT expression [expression]... 

Allocates and initializes 10 bytes of storage, name is the symbol you'll 
subsequently use to refer to the data, expression can be a constant expres- 
sion, a packed decimal constant expression, a question mark, an 80-bit 
floating-point number, or a DUPlicated expression. 

DW Ideal, MASM 

[name] DW [type PTR] expression [expression]... 

Allocates and initializes 2 bytes (a word) of storage, name is the symbol 
you'll subsequently use to refer to the data, type followed by PTR adds 
debug information to the symbol being defined, so that Turbo Debugger 
can display its contents properly, type is one of the following: BYTE, 
WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a question mark, an address expression, or 
a DUPlicated expression. 

ELSE Ideal, MASM 

ELSE 

IF condition 

statementsl 
[ELSE 

statementsl] 
ENDIF 

Starts alternative conditional assembly block. The statements introduced 
by ELSE {statements!) are assembled ii condition evaluates to false. 
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ELSE IF Ideal, MASM 

ELSEIF 

IF condition! 

statementsl 
[ELSEIF condition! 

statements!] 
ENDIF 

Starts nested conditional assembly block if condition! is true. Several 
other forms of ELSEIF are supported: ELSEIF1, ELSEIF2, ELSEIFB, 
ELSEIFDEF, ELSEIFDIF, ELSEIFDIFI, ELSEIFE, ELSEIFIDN, 
ELSEIFIDNI, ELSEIFNB, and ELSEIFNDEF. 

EMUL Ideal, MASM 

Causes all subsequent numeric coprocessor instructions to be generated 
as emulated instructions, instead of real instructions. When your pro- 
gram is executed, you must have a software floating-point emulation 
package installed or these instructions will not work properly. 

END Ideal, MASM 

END [startaddress] 

Marks the end of a source file, startaddress is a symbol or expression that 
specifies the address in your program where you want execution to be- 
gin. Turbo Assembler ignores any text that appears after the END direc- 
tive. 

ENDIF Ideal, MASM 

ENDIF 

IF condition 
statements 
ENDIF 

Marks the end of a conditional assembly block started with one if the 
VFxxxx directives. 

ENDM Ideal, MASM 

Marks the end of a repeat block or a macro definition. 

ENDP Ideal, MASM 

ENDP [procname] 
[procname] ENDP 

Marks the end of a procedure. If procname is supplied, it must match the 
procedure name specified with the PROC directive that started the proce- 
dure definition. 
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ENDS Ideal, MASM 

ENDS [segmentname I strucname] 
[segmentname I strucname]ENDS 

Marks end of current segment, structure or union. If you supply the op- 
tional name, it must match the name specified with the corresponding 
SEGMENT, STRUC, or UNION directive. 

ENUM Ideal, MASM 

ENUM name[enum_var[,enum_var...]] 
name ENUM [enum_var[,enum_var...]] 

Declares an enumberated data type. 

EQU Ideal, MASM 

name EQU expression 

Defines name to be a string, alias, or numeric equate containing the result 
of evaluating expression. 

■ERR MASM 

.ERR <string> 

ERR Ideal, MASM 

ERR <string> 

Forces an error to occur at the line that this directive is encountered on in 
the source file. The optional string will display as part of the error mes- 
sage. 

■ ERR1 MASM 

.ERR1 <string> 

Forces an error to occur on pass 1 of assembly. The optional string will 
display as part of the error message. 

.ERR2 masm 

.ERR2 <string> 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (con- 
trolled by /m command-line option) is enabled. The optional string will 
display as part of the error message. 

■ERRB masm 

.ERRB argument <string> 

Forces an error to occur if argument is blank (empty). The optional string 
will appear as part of the error message. 
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.ERRDEF 

.ERRDEF masm 

.ERRDEF symbol <string> 

Forces an error to occur if symbol is defined. The optional string will ap- 
pear as part of the error message. 

.ERRDIF masm 

.ERRDIF argumentl,argument2 <string> 

Forces an error to occur if arguments are different. The comparison is 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

.ERRDIFI masm 

.ERRDIFI or gumentl Argument! <string> 

Forces an error to occur if arguments are different. The comparison is not 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

.ERRE masm 

.ERRE expression <string> 

Forces an error to occur if expression is false (0). The optional string will 
appear as part of the error message. 

.ERRIDN masm 

.ERRIDN argumentl Argument! <string> 

Forces an error to occur if arguments are identical. The comparison is 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

.ERRIDNI masm 

.ERRIDNI argument!, argument! <string> 

Forces an error to occur if arguments are identical. The comparison is not 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

ERRIF Ideal, MASM 

ERRTF expression <string> 
Forces an error to occur if expression is true (nonzero). The optional string 



will appear as part of the error message. 



PART 3, Directives 25 



ERRIF1 



ERRIF1 Ideal, MASM 

ERRIF1 <string> 
Forces an error to occur on pass 1 of assembly. The optional string will 



appear as part of the error message. 



ERRIF2 Ideal, MASM 

ERRIF2 <string> 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (con- 
trolled by /m command-line option) is enabled. The optional string will 
appear as part of the error message. 

ERRIFB Ideal, MASM 

ERRIFB argument <string> 
Forces an error to occur {{argument is blank (empty). The optional string 



will appear as part of the error message. 



ERRIFDEF Ideal, MASM 

ERRIFDEF symbol <string> 

Forces an error if symbol is defined. The optional string will appear as 
part of the error message. 

ERRIFDIF Ideal, MASM 

ERRIFDIF argument!, argument! <string> 

Forces an error to occur if arguments are different. The comparison is 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

ERRIFDIFI Ideal; MASM 

ERRIFDIFI argumentl argument! <string> 

Forces an error to occur if arguments are different. The comparison is not 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

ERRIFE Ideal, MASM 

ERRIFE expression <string> 

Forces an error if expression is false (0). The optional string will appear as 
part of the error message. 
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ERRIFIDN 

ERRIFIDN Ideal, MASM 

ERRIFIDN argumentl Argument! <string> 

Forces an error to occur if arguments are identical. The comparison is 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

ERRIFIDN I Ideal, MASM 

ERRIFIDNI argumentl,argument2 <string> 

Forces an error to occur if arguments are identical. The comparison is not 
case sensitive. The optional string will appear as part of the error mes- 
sage. 

ERRIFNB Ideal, MASM 

ERRIFNB argument <string> 

Forces an error to occur if argument is not blank. The optional string will 
appear as part of the error message. 

ERRIFNDEF ideal, masm 

ERRIFNDEF symbol <string> 

Forces an error to occur if symbol is not defined. The optional string will 
appear as part of the error message. 

.ERRNB masm 

.ERRNB argument <string> 

Forces an error to occur if argument is not blank. The optional string will 
appear as part of the error message. 

.ERRNDEF masm 

.ERRNDEF symbol <string> 

Forces an error to occur if symbol is not defined. The optional string will 
appear as part of the error message. 

.ERRNZ masm 

.ERRNZ expression <string> 

Forces an error to occur if expression is true (nonzero). The optional string 
will appear as part of the error message. 

EVEN Ideal, MASM 

Rounds up the location counter to the next even address. 
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EVENDATA Ideal, MASM 

Rounds up the location counter to the next even address in a data seg- 
ment. 

.EXIT MASM 

.EXIT [return_value_expr] 
Produces termination code. MASM mode only. Equivalent to EXITCODE. 

EXITCODE Ideal, MASM 

EXITCODE [return _value_expr] 

Produces termination code. You can use it for each desired exit point, re- 
turn _value_expr is a number to be returned to the operating system. If you 
don't specify return_value_expr, the value in AX is returned. 

EXITM Ideal, MASM 

Terminates macro- or block-repeat expansion and returns control to the 
next statement following the macro or repeat-block call. 

EXTRN Ideal, MASM 

EXTRN definition definition]... 

Indicates that a symbol is defined in another module, definition describes 
a symbol and has the following format: 

[language] name[countl]:type [-.count!] 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, ASSEMBLER, or PROLOG are to be applied to symbol 
name, name is the symbol that is defined in another module and can op- 
tionally be followed by countl, an array element multiplier that defaults 
to 1. type must match the type of the symbol where it's defined and must 
be one of the following: NEAR, FAR, PROC, BYTE, WORD, DWORD, 
DATAPTR, CODEPTR, FWORD, PWORD, QWORD, TBYTE, ABS, or 
a structure name, count! specifies how many items this external symbol 
defines and defaults to 1 if not specified. 

.FARDATA masm 

Same as FARDATA. MASM mode only. 

FARDATA ideal 

FARDATA [segmentname] 

Defines the start of a far initialized data segment, segmentname, if present, 
overrides the default segment name. 
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.FARDATA? 

.FARDATA? masm 

.FARDATA? [segmentmme] 

Defines the start of a far uninitialized data segment, segmentname, if pre- 
sent, overrides the default segment name. 

FASTIMUL Ideal, MASM 

VASTIMUL<dest_reg>,<source_r/m>,<value> 

Generates code that multiplies source register or memory address by 
value, and puts it into destination register. 

FLIPFLAG Ideal, MASM 

See syntax for the XOR processor instruction 

Optimized form of XOR that complements bits with shortest possible in- 
struction. Use only if the resulting contents of the flags registers are unim- 
portant. 

GETFIELD Ideal, MASM 

GETFiELD<field_name><destination_reg>,<source_r/m> 

Generates code that retrieves the value of a field found in the same 
source register or memory address, and sets the destination to that value. 

GLOBAL Ideal, MASM 

GLOBAL definition [definition]... 

Acts as a combination of the EXTRN and PUBLIC directives to define a 
global symbol, definition describes the symbol and has the following for- 
mat (boldface items are literal): 

{language] name [[ countl ]] -.type [:count2] 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, NOLANGUAGE, or PROLOG are to be applied to symbol 
name. If name is defined in the current source file, it is made public ex- 
actly as if used in a PUBLIC directive. If not, it is declared as an external 
symbol of type type, as if the EXTRN directive had been used, name can 
be followed by an optional array count multiplier, countl, which defaults 
to 1. type must match the type of the symbol in the module where it is de- 
fined and must be one of the following: NEAR, FAR, PROC, BYTE, 
WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, ABS, or a structure name, countl specifies how many 
items this symbol defines (1 is the default). 

GOTO Ideal, MASM 

GOTO tag_symbol 

Tells Turbo Assembler to resume execution at the specified macro tag 
(tag_symbol). GOTO terminates any conditional block that it is found in. 
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GROUP Ideal, MASM 

GROUP groupname segmentname [segmentname]... 
groupname GROUP segmentname [segmentname]... 

Associates groupname with one or more segments, so that all labels and 
variables defined in those segments have their offsets computed relative 
to the beginning of group groupname. segmentname can be either a seg- 
ment name defined previously with SEGMENT or an expression starting 
with SEG. In MASM mode, you must use a group override whenever 
you access a symbol in a segment that is part of a group. In Ideal mode, 
Turbo Assembler automatically generates group overrides for such sym- 
bols. 

IDEAL Ideal, MASM 

Enters Ideal assembly mode. Ideal mode will stay in effect until it is over- 
ridden by a MASM or QUIRKS directive. 

IF Ideal, MASM 

IF expression 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that expression is true (nonzero). 

IF1 Ideal, MASM 

IF1 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the current assembly pass is 
pass one. 

IF2 Ideal, MASM 

EP2 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that multiple-pass mode (control- 
led by the /m command-line option) is enabled and the current assembly 
pass is pass two. 
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IFB Ideal, MASM 

IFB argument 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that argument is blank (empty). 

IFDEF Ideal, MASM 

IFDEF symbol 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that symbol is defined. 

IFDIF Ideal, MASM 

IFDIF argumentl, argument! 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are different. 
The comparison is case sensitive. 

IFDIFI Ideal, MASM 

IFDIFI argumentl ,argument2 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are different. 
The comparison is not case sensitive. 
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IFE Ideal, MASM 

IFE expression 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that expression is false. 

IFIDN Ideal, MASM 

MDN argumentl jirgumentl 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are identical. 
The comparison is case sensitive. 

IFIDNI Ideal, MASM 

IFIDNI argumentl, argument! 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are identical. 
The comparison is not case sensitive. 

IFNB Ideal, MASM 

IFNB argument 

truestatements 
ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that argument is nonblank. 
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IFNDEF Ideal, MASM 

IFNDEF symbol 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that symbol is not defined. 

%INCL Ideal, MASM 

Enables listing of include files. This is the default INCLUDE file listing 
mode. 

INCLUDE MASM, Ideal 

FNCLUDE filename or INCLUDE "filename" 

Includes source code from file filename at the current position in the mod- 
ule being assembled. If no extension is specified, .ASM is assumed. 

INCLUDELIB MASM, Ideal 

FNCLUDELIB Rename or INCLUDELIB "filename" 

Causes the linker to include library filename at link time. If no extension is 

specified, .LIB is assumed. 

INSTR Ideal, MASM51 

name INSTR [start,]stringl,string2 

name is assigned the position of the first instance of string! in stringl. 
Searching begins at position start (position one if start not specified). If 
stringl does not appear anywhere within stringl, name is set to zero. 

IRP Ideal, MASM 

DRP parameter \argl[,arg2]... 

statements 
ENDM 

Repeats a block of statements with string substitution, statements are as- 
sembled once for each argument present. The arguments may be any 
text, such as symbols, strings, numbers, and so on. Each time the block is 
assembled, the next argument in the list is substituted for any instance of 
parameter in the statements. 
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IRPC Ideal, MASM 

IRPC parameter string 

statements 
ENDM 

Repeats a block of statements with character substitution, statements are 
assembled once for each character in string. Each time the block is assem- 
bled, the next character in the string is substituted for any instances of pa- 
rameter in statements. 

J MP Ideal, MASM 

JMP<instance_ptr>METHOD{<object_name>:} 
<method_name> {USES{segreg: }offsreg\ 

Functions exactly like CALL.. METHOD except that it generates a JMP in- 
stead of a CALL and it cleans up the stack if there are LOCAL or USES 
variables on the stack. Use primarily for tail recursion. 

JUMPS Ideal, MASM 

Causes Turbo Assembler to look at the destination address of a condi- 
tional jump instruction, and if it is too far away to reach with the short 
displacement that these instructions use, it generates a conditional jump 
of the opposite sense around an ordinary jump instruction to the desired 
target address. This directive has the same effect as using the /JJUMPS 
command-line option. 

LABEL MASM, Ideal 

name LABEL type 
LABEL name type 

Defines a symbol name to be of type type, name must not have been de- 
fined previously in the source file, type must be one of the following: 
NEAR, FAR, PROC, BYTE, WORD, DATAPTR, CODEPTR, DWORD, 
FWORD, PWORD, QWORD, TBYTE, or a structure name. 

.LALL MASM 

Enables listing of macro expansions. 

LARGESTACK ideal, masm 

Indicates that the stack is 32 bit. 

.LFCOND masm 

Shows all statements in conditional blocks in the listing. 
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%LINUM 

%LINUM Ideal, MASM 

%LINUM size 

Sets the width of the line-number field in listing file to size columns. The 
default is four columns. 

%LIST Ideal, MASM 

Shows source lines in the listing. This is the default listing mode. 

_ 

.LIST MASM 

Same as %LIST. MASM mode only. 

LOCAL Ideal, MASM 

In macros: 

LOCAL symbol [,symbol]... 

In procedures: 

LOCAL element [,element]... [=symbol] 

Defines local variables for macros and procedures. Within a macro defini- 
tion, LOCAL defines temporary symbol names that are replaced by new 
unique symbol names each time the macro is expanded. LOCAL must ap- 
pear before any other statements in the macro definition. 

Within a procedure, LOCAL defines names that access stack locations as 
negative offsets relative to the BP register. If you end the argument list 
with an equal sign (=) and a symbol, that symbol will be equated to the 
total size of the local symbol block in bytes. Each element has the follow- 
ing syntax (boldface brackets are literal): 

symname \\countl\] [:[debug_size] [:type] [:count2]] 

type is the data type of the argument. It can be one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, NEAR, FAR, PROC, or a structure name. If you don't 
specify a type, WORD size is assumed. 

count! specifies how many items of type the symbol defines. The default 
for count! is 1 if it is not specified. 

countl is an array element size multiplier. The total space allocated for 
the symbol is count! times the length specified by the type field times 
countl. The default for countl is 1 if it is not specified. 

The optional debug_size has this syntax: 

[type] PTR 
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LOCALS 

LOCALS Ideal, MASM 

LOCALS [prefix] 

Enables local symbols, whose names will begin with two at-signs (@@) or 
the two-character prefix if it is specified. Local symbols are automatically 
enabled in Ideal mode. 

MACRO Ideal, MASM 

MACRO name [parameter [,parameter]...] 
name MACRO [parameter [/parameter].. \ 

Defines a macro to be expanded later when name is encountered, parame- 
ter is a placeholder that you use in the the body of the macro definition 
wherever you want to substitute one of the actual arguments the macro 
is called with. 

%MACS Ideal, MASM 

Enables listing of macro expansions. 

MASKFLAG Ideal, MASM 

See the syntax for the AND processor instruction 

Optimized form of AND that clears bits with the shortest possible instruc- 
tion. Use only if the resulting contents of the flags registers are unimpor- 
tant. 

MASM Ideal, MASM 

Enters MASM assembly mode. This is the default assembly mode for 
Turbo Assembler. 

MASM51 Ideal, MASM 

Enables assembly of some MASM 5.1 enhancements. 

MODEL Ideal, MASM 

MODEL [model modifier] memorymodel [module name] 
[,[language modifier] language ] [,model modifier] 

Sets the memory model for simplified segmentation directives, model modi- 
fier can come before memorymodel or at the end of the statement and must 
be either NEARSTACK or FARSTACK if present, memorymodel is TINY, 
SMALL, MEDIUM, COMPACT, LARGE, HUGE or TCHUGE. module 
name is used in the large models to declare the name of the code seg- 
ment, language modifier is WINDOWS, ODDNEAR, ODDFAR, or NOR- 
MAL and specifies generation of MSWindows procedure entry and exit 
code, language specifies which language you will be calling from to access 
the procedures in this module: C, PASCAL, BASIC, FORTRAN, 
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.MODEL 



PROLOG, or NOLANGUAGE. Turbo Assembler automatically gener- 
ates the appropriate procedure entry and exit code when you use the 
PROC and ENDP directives, language also tells Turbo Assembler which 
naming conventions to use for public and external symbols, and in what 
order procedure arguments were pushed onto the stack by the calling 
module. Also, the appropriate form of the RET instruction is generated to 
remove the arguments from the stack before returning if required. 

.MODEL masm 

Same as MODEL. MASM mode only. 

MULTERRS Ideal, MASM 

Allows multiple errors to be reported on a single source line. 

NAME Ideal, MASM 

NAME modulename 

Sets the object file's module name. This directive has no effect in MASM 
mode; it only works in Ideal mode. 

%NEWPAGE Ideal, MASM 

Starts a new page in the listing file. 

%NOCONDS Ideal, MASM 

Disables the placement of statements in conditional blocks in the listing 
file. 

%NOCREF Ideal, MASM 

%NOCREF [symbol, ... ] 

Disables cross-reference listing (CREF) information accumulation. If you 
supply one or more symbol names, cross-referencing is disabled only for 
those symbols. 

%NOCTLS Ideal, MASM 

Disables placement of listing-control directives in the listing file. This is 
the default listing-control mode for Turbo Assembler. 

NOEMUL Ideal, MASM 

Causes all subsequent numeric coprocessor instructions to be generated 
as real instructions, instead of emulated instructions. When your pro- 
gram is executed, you must have an 80x87 coprocessor installed or these 
instructions will not work properly. This is the default floating-point as- 
sembly mode for Turbo Assembler. 
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%NOINCL 

%NOINCL Ideal, MASM 

Disables listing of source lines from INCLUDE files. 

NOJUMPS Ideal, MASM 

Disables stretching of conditional jumps enabled with JUMPS. This is the 
default mode for Turbo Assembler. 

%NOUST Ideal, MASM 

Disables output to the listing file. 

NOLOCALS Ideal, MASM 

Disables local symbols enabled with LOCALS. This is the default for 
Turbo Assembler's MASM mode. 

%NOMACS Ideal, MASM 

Lists only macro expansions that generate code. This is the default macro 
listing mode for Turbo Assembler. 

NOMASM51 Ideal, MASM 

Disables assembly of certain MASM 5.1 enhancements enabled with 
MASM51. This is the default mode for Turbo Assembler. 

NOMULTERRS ideal, masm 

Allows only a single error to be reported on a source line. This is the de- 
fault error-reporting mode for Turbo Assembler. 

NOSMART Ideal, MASM 

Disables code optimizations that generate different code than MASM. 

%NOSYMS Ideal, MASM 

Disables placement of the symbol table in the listing file. 

%NOTRUNC Ideal, MASM 

Prevents truncation of fields whose contents are longer than the corre- 
sponding field widths in the listing file. 
60 points 

NOWARN Ideal, MASM 

NOWARN [warnclass] 

Disables warning messages with warning identifier warnclass, or all warn- 
ing messages if warnclass is not specified. 
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ORG Ideal, MASM 

ORG expression- 
Sets the location counter in the current segment to the address specified 
by expression. 

%OUT MASM 

%OUTtext 
Displays text on screen. 

PI 86 Ideal, MASM 

Enables assembly of 80186 processor instructions. 

P286 Ideal, MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

P286N Ideal, MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

P286P Ideal, MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

P287 Ideal, MASM 

Enables assembly of 80287 numeric coprocessor instructions. 

P386 Ideal, MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 

P386N Ideal, MASM 

Enables assembly of non-privileged (real mode) 386 processor instruc- 
tions and 387 numeric coprocessor instructions. 

P386P Ideal, MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 

P387 Ideal, MASM 

Enables assembly of 387 numeric coprocessor instructions. 
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P486 



P486 Ideal, MASM 

Enables assembly of all i486 (including protected mode) processor instruc- 
tions. 

P486N Ideal, MASM 

Enables assembly of non-privileged (real mode) i486 processor instruc- 
tions. 

P487 Ideal, MASM 

Enables assembly of 487 numeric processor instructions. 

P586 Idedl, MASM 

Enables assembly of all Pentium (including protected mode) processor in- 
structions. 

P586N Ideal, MASM 

Enables assembly of non-privileged (real mode) Pentium processor in- 
structions. 

P587 Ideal, MASM 

Enables assembly of Pentium numeric processor instructions. 

P8086 Ideal, MASM 

Enables assembly of 8086 processor instructions only. This is the default 
processor instruction mode for Turbo Assembler. 

P8087 Ideal, MASM 

Enables assembly of 8087 numeric coprocessor instructions only. This is 
the default coprocessor instruction mode for Turbo Assembler. 
PAGE, MASM 

%PAGESIZE Ideal, MASM 

PAGE [rows] [,cols] 
%PAGESIZE [rows] [,cols] 

Sets the listing page height and width, starts new pages, rows specifies 
the number of lines that will appear on each listing page (10. .255). cols 
specifies the number of columns wide the page will be (59..255). Omitting 
rows or cols leaves the current setting unchanged. If you follow PAGE 
with a plus sign (+), a new page starts, the section number is incre- 
mented, and the page number restarts at 1. PAGE with no arguments 
forces the listing to resume on a new page, with no change in section 
number. 
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%PCNT 

%PCNT Ideal, MASM 

%FCNT zvidth 

Sets segment:offset field width in listing file to width columns. The de- 
fault is 4 for 16-bit segments and 8 for 32-bit segments. 

PN087 Ideal, MASM 

Prevents the assembling of numeric coprocessor instructions (real or emu- 
lated). 

%POPLCTL Ideal, MASM 

Resets the listing controls to the way they were when the last 
%PUSHLCTL directive was issued. 

POPSTATE Ideal, MASM 

Returns to last saved state from Turbo Assembler's internal state stack. 

PROC Ideal, MASM 

For VERSION T310 or earlier: 

PROC [language modifier] [language] name [distance] 
[USES items,] [argument [/irgument]...] 
[RETURNS argument [argument]...] 

For VERSION T320 or later: 

PROC name [language modifier] [language] [distance] 

[USES items,] [argument [argument]...] 

[RETURNS argument [/irgument]...] 
name PROC [language modifier] [language] [distance] 

[USES items,] [argument [/irgument]...] 

[RETURNS argument [/irgument]...] 

Defines the start of procedure name, language modifier is either 
WINDOWS or NO WINDOWS, to specify generation of MSWindows en- 
try/exit code, language specifies which language you will be calling from 
to access this procedure: C, PASCAL, BASIC, FORTRAN, 
NOLANGUAGE, or PROLOG. This determines symbol naming conven- 
tions, the order of any arguments on the stack, and whether the argu- 
ments will be left on the stack when the procedure returns, distance is 
NEAR or FAR and determines the type of RET instruction that will be as- 
sembled at the end of the procedure, items is a list of registers and/or sin- 
gle-token data items to be pushed on entry and popped on exit from the 
procedure, argument describes an argument the procedure is called with. 
Each argument has the following syntax: 

argname[[countl]] [[-.distance] [PTR] type] [.count!] 

argname is the name you'll use to refer to this argument throughout the 
procedure, distance is NEAR or FAR to indicate that the argument is a 
pointer of the indicated size, type is the data type of the argument and 
can be BYTE, WORD, DWORD, FWORD, PWORD, QWORD, TBYTE, 
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PROCDESC 



or a structure name. WORD is assumed if none is specified, countl and 
count! are the number of elements of type. PTR tells Turbo Assembler to 
emit debug information to let Turbo Debugger know that the argument is 
a pointer to a data item. Using PTR without distance causes the pointer 
size to be based on the current memory model and segment address size. 
RETURNS introduces one or more arguments that won't be popped 
from the stack when the procedure returns. 

PROCDESC Ideal, MASM 

PROCDESC name [language] [language modifier] [distance] 

[arguments] 
name PRODESC [[languagejnodifier] language] [distance] 

[arguments] 

Declares a procedure prototype, which lets Turbo Assembler check the 
types and number of parameters to procedure calls and declarations, and 
specifies language and distance. Also serves to PUBLIC or EXTRN the 
procedure name. 

PROCTYPE Ideal, MASM 

PROCTYPE name [procedure _description] 
name PROCTYPE [procedure _description] 

procedure ^description has the following syntax: 

[[language_modifier]language] [distance] [argument Jist] 

argumentjist has the following syntax: 
argument[,argumeni\... 

where each argument has the following syntax: 

[argname][[countl_expressions]]:complex_type[:count2_expression] 

Declares a procedure type. Describes a procedure but does not create a 
prototype for it. Can be used in place of the language specifier in a call to 
allow argument type checking during compilation. 

PUBLIC Ideal, MASM 

PUBLIC [language] symbol [,[language] symbol]... 

Declares symbol to be accessible from other modules. If language is speci- 
fied (C, PASCAL, BASIC, FORTRAN, ASSEMBLER, or PROLOG), sym- 
bol is made public after having the naming conventions of the specified 
language applied to it. 

PUBUCDLL Ideal, MASM 

PUBLICDLL [language] symbol [,[language] symbol]... 

Declares symbols to be accessible as dynamic link entry points from 
other modules, symbol (a PROC or program label, data variable name, or 
numeric constant defined with EQU) becomes accessible to other pro- 
grams under Windows. If language is specified (C, PASCAL, BASIC, 
FORTRAN, PROLOG, or NOLANGUAGE), symbol is made public after 
having the naming conventions of the specified language applied to it. 
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PURGE 



PURGE Ideal, MASM 

PURGE macroname [,macroname\... 
Removes macro definition macroname. 

%PUSHLCTL Ideal, MASM 

Saves current listing controls on a 16-level stack. 

PUSHSTATE Ideal, MASM 

Saves current operating state on an internal stack that is 16 levels deep. 

QUIRKS Ideal, MASM 

Allows you to assemble a source file that makes use of one of the true 
MASM bugs. 

.RADIX MASM 

Same as RADIX. MASM mode only. 

RADIX Ideal, MASM 

RADIX radix 
Sets the default radix for integer constants in expressions to 2, 8, 10, or 16. 

RECORD MASM, Ideal 

name RECORD field [field]... 
RECORD name field [field]... 

Defines record name that contains bit fields. Each field describes a group 
of bits in the record and has the following format (boldface items are lit- 
eral): 

fieldname:width[=expression] 

fieldname is the name of a field in the record, width (1..16) specifies the 
number of bits in the field. If the total number of bits in all fields is 8 or 
less, the record will occupy 1 byte; 9. .16 bits will occupy 2 bytes; other- 
wise, it will occupy 4 bytes, expression provides a default value for the 
field. 

REPT Ideal, MASM 



REPT expression 

statements 
ENDM 



Repeats a block of statements expression times. 
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RETCODE Ideal, MASM 

Generates either a near return (2-byte displacement) or a far return (4- 
byte displacement) depending on the size of the memory model declared 
in the .MODULE directive. A tiny, small, or compact memory model re- 
sults in a near return, while a medium, large, or huge memory model re- 
sults in a far return. See the RET processor instruction in Part 4 for more 
information. 

RETF Ideal, MASM 

Generates a far return (4-byte displacement) from a procedure. See the 
RET processor instruction in Part 4 for more information. 

RETN Ideal, MASM 

Generates a near return (2-byte displacement) from a procedure. See the 
RET processor instruction in Part 4 for more information. 

.SALL MASM 

Suppresses the listing of all statements in macro expansions. 

SEGMENT MASM, Ideal 

SEGMENT name [align] [combine] [use] ['class'] 
name SEGMENT [align] [combine] [use] ['class'] 

Defines segment name with full attribute control. If you have already de- 
fined a segment with the same name, this segment is treated as a continu- 
ation of the previous one. align specifies the type of memory boundary 
where the segment must start: BYTE, WORD, DWORD, PARA (default), 
or PAGE, combine specifies how segments from different modules but 
with the same name will be combined at link time: AT expression (locates 
segment at absolute paragraph address expression), COMMON (locates 
this segment and all other segments with the same name at the same ad- 
dress), MEMORY (concatenates all segments with the same name to 
form a single contiguous segment), PRIVATE (does not combine this seg- 
ment with any other segments) this is the default used if none specified), 
PUBLIC (same as MEMORY above), STACK (concatenates all segments 
with the same name to form a single contiguous segment, then initializes 
SS to the beginning of the segment and SP to the length of the segment) 
or VIRTUAL (defines a special kind of segment that will be treated as a 
common area and attached to another segment at link time), use specifies 
the default word size for the segment if 386 code generation is enabled, 
and can be either USE16 or USE32. class controls the ordering of seg- 
ments at link time: segments with the same class name are loaded into 
memory together, regardless of the order in which they appear in the 
source file. 
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.SEQ MASM 

Sets sequential segment-ordering. This is the default ordering mode for 
Turbo Assembler. .SEQ has the same function as the /s command-line op- 
tion. 

SETFIELD Ideal, MASM 

SETFJELD<field_name><destination_r/m>,<source_reg> 

Generates code that sets a value in a record field. Sets the field in the des- 
tination register or memory address with the contents of a source register. 

SETFLAG Ideal, MASM 

see the syntax for the OR processor instruction 

Optimized form of OR that sets bits with shortest possible instruction. 
Use only if the resulting contents of the flags register is unimportant. 

.SFCOND masm 

Prevents statements in false conditional blocks from appearing in the list- 
ing file. 

SIZESTR Ideal, MASM51 

name SIZESTR string 

Assigns the number of characters in string to name. A null string has a 
length of zero. 



SMALLSTACK 


Ideal, MASM 


Indicates that the stack is 16 bit. 




SMART 


Ideal, MASM 


Enables all code optimizations. 




.STACK 


MASM 


Same as STACK. MASM mode only. 





STACK Ideal, MASM 

STACK [size] 

Defines the start of the stack segment, allocating size bytes. 1024 bytes are 
allocated if size is not specified. 

.STARTUP masm 

Provides initialization code. MASM mode only. Equivalent to STARTUP- 
CODE. 
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STARTUPCODE ideal, masm 

Provides initialization code and marks the beginning of the program. 

STRUC Ideal, MASM 

[name] STR\JC{<modifiers>}{<parent_name>}[MEIHOD<method_list>} 

<structure_data> 
ENDS [name] 

STRUC [name]{<modifiers>}{<parent_name>}{METH.OD<method_list>} 

<structure_data> 
ENDS [name] 

parentjiame is the name of the parent object's data structure, method Jist is 
like that of TABLE, structure _data is any (additional) data present in an in- 
stance of the object, modifiers can be GLOBAL, NEAR, or FAR. 

SUBSTR Ideal, MASM51 

name SUBSTR string, position[,size] 

Defines a new string name consisting of characters from string starting at 
position, with a length of size. All the remaining characters in string, start- 
ing from position, are assigned to name if size is not specified. 

SUBTTL masm 

Same as %SUBTTL. MASM mode only. 

%SUBTTL Ideal, MASM 

%SUBTTL"texf 
Sets subtitle in listing file to text. 

%SYMS Ideal, MASM 

Enables symbol table placement in listing file. This is the default symbol 
listing mode for Turbo Assembler. 

TABLE Ideal, MASM 

TABLE name [table jnember [,table_member...]] 
Constructs a table structure used to contain method pointers for objects. 

%TABSIZE Ideal, MASM 

%TABSIZE width 

Sets the number of columns between tabs in the listing file to width. The 
default is 8 columns. 

TBLINIT Ideal, MASM 

Initializes pointer in an object to the virtual method table. 
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TBLINST 

TBLINST 



Ideal, MASM 



Creates an instance of the virtual table for the current object and defines 
©Table Addr_<object>. Must be used after every object definition that in- 
cludes virtual methods, so that the virtual table is allocated. You should 
use this directive in only one module of your program. 



TBLPTR 

TBLPTR 



Ideal, MASM 



Places a virtual table pointer within the object data. Defines a structure 
member of the name @Mptr _<object>. This can only be used inside an ob- 
ject definition. 

TESTFLAG Ideal, MASM 

See the syntax for the TEST processor instruction 

Optimized form of TEST that tests bits with the shortest possible instruc- 
tion. 

%TEXT Ideal, MASM 

%TEXT width 
Sets width of source field in listing file to width columns. 



.TFCOND 

Toggles conditional block-listing mode. 



MASM 



TITLE 

Same as %TITLE. MASM mode only. 



MASM 



%TITLE 

%TITLE "text" 
Sets title in listing file to text . 



Ideal, MASM 



%TRUNC 

Truncates listing fields that are too long. 



Ideal, MASM 



TYPEDEF 

TYPEDEF typejiame complexjype 
type_name TYPEDEF complexjype 

Defines named types. 



Ideal, MASM 



PART 3, Directives 



47 



UDATASEG 

UDATASEG Ideal, MASM 

Defines the start of an uninitialized data segment. 

UFARDATA Ideal, MASM 

Defines the start of an uninitialized far data segment. 

UNION Ideal, MASM (disabled by QUIRKS) 

UNION name 

fields 

ENDS [name] 
name UNION 

fields 
[name] ENDS 

Defines a union called name. A union is just like a STRUC except that all 
its members have an offset of zero from the start of the union. This re- 
sults in a set of fields that are overlayed, allowing you to refer to the 
memory area defined by the union with different names and different 
data sizes. The length of a union is the length of its largest member, not 
the sum of the lengths of its members as in a STRUC. fields define the 
fields that comprise the union. Each field uses the normal data allocation 
directives (DB, DW, and so on) to define its size. 

USES Ideal, MASM 

USES item [,item\... 

Indicates which registers or single-token data items you want to have 
pushed at the beginning of the enclosing procedure and which ones you 
want popped just before the procedure returns. You must use this direc- 
tive before the first instruction that actually generates code in your proce- 
dure. 

VERSION MASM, Ideal 

VERSION <version _ID> 

Places Turbo Assembler in the equivalent operating mode for the speci- 
fied version. 

WARN Ideal, MASM 

WARN [warnclass] 

Enables the type of warning message specified with warnclass, or all warn- 
ings if warnclass is not specified, warnclass may be one of: ALN, ASS, 
BRK, ICG, LCO, OPI, OPP, OPS, OVF, PDC, PRO, PQK, RES, or TPI. 
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WHILE Ideal, MASM 

WHILE while_expression 

macro body 
ENDM 

Repeats a macro body until while _expression evaluates to (false). 

.XALL MASM 

Causes only macro expansions that generate code or data to be listed. 

.XCREF masm 

Disables cross-reference listing (CREF) information accumulation. 

.XLIST MASM 

Disables subsequent output to listing file. 
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Processor instructions 
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This part presents instructions for the x86 in alphabetical order. For each 
instruction, the forms are given for each operand combination, including 
object code produced, operands required, execution time, and a descrip- 
tion. For each instruction, there is an operational description and a sum- 
mary of exceptions generated. 

Operand-size and address-size attributes 

When executing an instruction, the x86 can address memory using either 
16- or 32-bit addresses. Consequently, each instruction that uses memory 
addresses has associated with it an address-size attribute of either 16 or 
32 bits. Sixteen-bit addresses imply both the use of a 16-bit displacement 
in the instruction and the generation of a 16-bit address offset (segment 
relative address) as the result of the effective address calculation. Thirty- 
two-bit addresses imply the use of a 32-bit displacement and the genera- 
tion of a 32-bit address Offset. Similarly, an instruction that accesses 
words (16 bits) or doublewords (32 bits) has an operand-size attribute of 
either 16 or 32 bits. 

The attributes are determined by a combination of defaults, instruction 
prefixes, and (for programs executing in protected mode) size-specifica- 
tion bits in segment descriptors. 

Default segment attribute 

For programs executed in protected mode, the D-bit in executable-seg- 
ment descriptors determines the default attribute for both address size 
and operand size. These default attributes apply to the execution of all in- 
structions in the segment, A value of zero in the D-bit sets the default ad- 
dress size and operand size to 16 bits; a value of one, to 32 bits. 

Programs that execute in real mode or virtual-8086 mode have 16-bit ad- 
dresses and operands by default. 

Operand-size and address-size instruction prefixes 

The internal encoding of an instruction can include two byte-long pre- 
fixes: the address-size prefix, 67H, and the operand-size prefix, 66H. (A 
later section, "Instruction format," shows the position of the prefixes in an 
instruction's encoding.) These prefixes override the default segment attri- 
butes for the instruction that follows. Table 4.1 shows the effect of each 
possible combination of defaults and overrides. 
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Table 4. 1 Effective size attributes 



Segment default D= ... 














1 


1 


1 


1 


Operand-size prefix 66h 


N 


N 


Y 


Y 


N 


N 


Y 


Y 


Address-size prefix 67h 


N 


Y 


N 


Y 


N 


Y 


N 


Y 


Effective operand size 


16 


16 


32 


32 


32 


32 


16 


16 


Effective address size 


16 


32 


16 


32 


32 


16 


32 


16 



Y = Yes, this instruction prefix is present. 
N = No, this instruction prefix is not present. 



Address-size attribute for stack 



Instructions that use the stack implicitly (for example, POP EAX) also 
have a stack address-size attribute of either 16 or 32 bits. Instructions 
with a stack address-size attribute of 16 use the 16-bit SP stack pointer 
register; instructions with a stack address-size attribute of 32 bits use the 
32-bit ESP register to form the address of the top of the stack. 

The stack address-size attribute is controlled by the B-bit of the data-seg- 
ment descriptor in the SS register. A value of zero in the B-bit selects a 
stack address-size attribute of 16; a value of one selects a stack address- 
size attribute of 32. 



Instruction format 



All instruction encodings are subsets of the general instruction format 
shown in Figure 4.1. Instructions consist of optional instruction prefixes, 
one or two primary opcode bytes, possibly an address specifier consist- 
ing of the ModR/M byte and the SIB (scale index base) byte, a displace- 
ment, if required, and an immediate data field, if required. 

Smaller encoding fields can be defined within the primary opcode or op- 
codes. These fields define the direction of the operation, the size of the 
displacements, the register encoding, or sign extension; encoding fields 
vary depending on the class of operation. 

Most instructions that can refer to a operand in memory have an ad- 
dressing form byte following the primary opcode byte(s). This byte, 
called the ModR/M byte, specifies the address form to be used. Certain 
encodings of the ModR/M byte indicate a second addressing byte, the 
SIB byte, which follows the ModR/M byte and is required to fully spec- 
ify the addressing form. 
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Figure 4.1 
386 instruction format 



Instruction 
prefix 


Address- 
size prefix 


Operand- 
size prefix 


Segment 
override 


or 1 


or 1 or 1 


o or 1 


Number of bytes 



Opcode 


Modr/M 


SIB 


Displacement 


Immediate 


1 or 2 or 1 or 1 0, 1 , 2, or 4 0, 1 , 2, or 4 


Number of bytes 



Addressing forms can include a displacement immediately following 
either the ModR/M or SIB byte. If a displacement is present, it can be 8, 
16, or 32 bits. 

If the instruction specifies an immediate operand, the immediate operand 
always follows any displacement bytes. The immediate operand, if speci- 
fied, is always the last field of the instruction. 

■ The following are the allowable instruction prefix codes: 

■ F3h: REP prefix (used only with string instructions) 

■ F3h: REPE/REPZ prefix (used only with string instructions) 

■ F2h: REPNE/REPNZ prefix (used only with string instructions) 

■ FOh: LOCK prefix 

The following are the segment override prefixes: 

■ 2Eh: CS segment override prefix 

■ 36h: SS segment override prefix 

■ 3Eh: DS segment override prefix 

■ 26h: ES segment override prefix 

■ 64h: FS segment override prefix (386 processors and greater) 

■ 65h: GS segment override prefix (386 processors and greater) 

■ 66h: Operand-size override 

■ 67h: Address-size operand 
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ModR/M and SIB bytes 



The ModR/M and SIB bytes follow the opcode byte(s) in many of the x86 
instructions. They contain the following information: the indexing type or 
register number to be used in the instruction; the register to be used, or 
more information to select the instruction; and the base, index, and scale 
information. 

The ModR/M byte contains three fields of information: 

■ The mod field, which occupies the two most significant bits of the byte, 
combines with the r/m field to form 32 possible values: 8 registers and 
24 indexing modes. 

■ The reg field, which occupies the next three bits following the mod 
field, specifies either a register number or three more bits of opcode in- 
formation. The meaning of the reg field is determined by the first (op- 
code) byte of the instruction. 

■ The r/m field, which occupies the three least-significant bits of the byte, 
can specify a register as the location of an operand, or can form part of 
the addressing-mode encoding in combination with the mod field as 
described earlier. 

■ The based indexed and scaled indexed forms of 32-bit addressing re- 
quire the SIB byte. The presence of the SIB byte is indicated by certain 
encodings of the ModR/M byte. The SIB byte then includes the follow- 
ing fields: 

■ The ss field, which occupies the 2 most-significant bits of the byte, 
specifies the scale factor. 

■ The index field, which occupies the next 3 bits following the ss field 
specifies the register number of the index register. 

■ The base field, which occupies the 3 least-significant bits of the byte, 
specifies the register number of the base register. 

Figure 4.2 shows the format of the ModR/M and SIB bytes. 



Figure 4.2 
ModR/M and SIB byte formats 



7 6 


Modr/M Byte 
5 4 3 2 1 


Mod 


Reg/Opcode 


R/M 


SIB (Scale Index Base) Byte 
7 6 5 4 3 2 1 


SS 


Index 


Base 



The values and corresponding addressing forms of the ModR/M and SIB 
bytes are shown in Tables 4.2, 4.3, and 4.4. 
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Table 4.2 16-bit addressing forms 


: with 


ModR/M byte 










r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 






r16(/r) 


AX 


cx 


DX 


BX 


SP 


BP 


SI 


Dl 






r32(/r) 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






/digit (opcode) 





1 


2 


3 


4 


5 


6 


7 






REG = 


000 


001 


010 


011 


100 


101 


110 


111 






Effective address 


ModR/M 


ModR/M values 


in hexadecimal 






[BX + SI] 




000 


00 


08 


10 


18 


20 


28 


30 


38 


[BX + DI] 




001 


01 


09 


11 


19 


21 


29 


31 


39 


[BP + SI] 




010 


02 


0A 


12 


1A 


22 


2A 


32 


3A 


[BP + Dl] 


00 


011 


03 


0B 


13 


1B 


23 


2B 


33 


3B 


[SI] 




100 


04 


OC 


14 


1C 


24 


2C 


34 


3C 


[Dl] 




101 


05 


0D 


15 


1D 


25 


2D 


35 


3D 


disp16 




110 


06 


0E 


16 


1E 


26 


2E 


36 


3E 


[BX] 




111 


07 


OF 


17 


1F 


27 


2F 


37 


3F 


[BX + SI] + disp8 




000 


40 


48 


50 


58 


60 


68 


70 


78 


[BX + Dl] + disp8 




001 


41 


49 


51 


59 


61 


69 


71 


79 


[BP + SI] ■+ disp8 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


[BP + Dl] + disp8 


01 


011 


43 


4B 


53 


5B 


63 


6B 


73 


7B 


[SI] + disp8 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 


[Dl] + disp8 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 


[BP] + disp8 ' 




110 


46 


4E 


56 


5E 


66 


6E 


76 


7E 


[BX] + disp8 




111 


47 


4F 


57 


5F 


67 


6F 


77 


7F 


[BX + SI] + disp16 - 




000 


80 


88 


90 


98 


AO 


A8 


BO 


B8 


[BX + DI] + disp16 




001 


81 


89 


91 


99 


A1 


A9 


B1 


B9 


[BP + SI] + disp16 




010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


[BP + DI] + disp16 


10 


011 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


[Sl] + disp16 




100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 


[Dl]+disp16 




101 


85 ' 


8D 


95 


9D 


A5 


AD 


B5 


BD 


[BP] + disp16 




110 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


[BX] + disp16 




111 ' 


87 


8F 


97 


9F 


A7 


AF 


B7 


BF 


EAX/AX/AL (386) 




000 


CO 


C8 


DO 


D8 


EO 


E8 


FO 


F8 


ECX/CX/CL (386) 




001 


C1 


C9 


D1 


D9 


E1 


E9 


F1 


F9 


EDX/DX/DL (386) 




010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


EBX/BX/BL (386) 


11 


011 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


ESP/SP/AH (386) 




100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


FC 


EBP/BP/CH (386) 




101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


ESI/SI/DH (386) 




110 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


EDI/DI/BH (386) 




111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



disp8 denotes an 8-bit displacement following the ModR/M byte, to be sign-extended and added to the index. disp16 
denotes a 16-bit displacement following the ModR/M byte, to be added to the index. Default segment register is SS 
for the effective addresses containing a BP index, DS for other effective addresses. 
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Table 4.3 32-bit addressing forms with ModR/M byte (386 only) 






r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 






r16(/r) 


AX 


CX 


DX 


BX 


SP 


BP 


SI 


Dl 






r32(/r) 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






/digit(opcode) 





1 


2 


3 


4 


5 


6 


7 






REG = 


000 


001 


010 


011 


100 


101 


110 


111 






Effective address 


ModR/M 


ModR/M values 


in hexadecimal 






[EAX] 




000 


00 


08 


10 


18 


20 


28 


30 


38 


[ECX] 




001 


ot 


09 


11 


19 


21 


29 


31 


39 


[EDX] 




010 


02 


0A 


12 


1A 


22 


2A 


32 


3A 


[EBX] 


00 


011 


03 


0B 


13 


1B 


23 


2B 


33 


3B 


[- "] [- "I 




100 


04 


OC 


14 


1C 


24 


2C 


34 


3C 


disp32 




101 


05 


0D 


15 


1D 


25 


2D 


35 


3D 


[ESI] 




110 


06 


0E 


16 


1E 


26 


2E 


36 


3E 


[EDI] 




111 


07 


OF 


17 


1F 


27 


2F 


37 


3F 


disp8[EAX] 




000 


40 


48 


50 


58 


60 


68 


70 


78 


disp8[ECX] 




001 


41 


49 


51 


59 


61 


69 


71 


79 


disp8[EDX] 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


disp8[EPX]; 


01 


011 


43 


4B 


53 


5B 


63 


6B 


73 


7B 


disp8[- -][--] 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 


disp8[EBP] 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 


disp8[ESI] 




110 


46 


4E 


56 


5E 


66 


6E 


76 


7E 


disp8[EDI] 




111 


47 


4F 


57 


5F 


67 


6F 


77 


7F 


disp32[EAX] 




000 


80 


88 


90 


98 


A0 


A8 


B0 


B8 


disp32[ECX] 




001 


81 


89 


91 


99 


A1 


A9 


B1 


B9 


disp32[EDX] 




010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


disp32[EBX] 


10 


011 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


dis P 32[- -] [- -] 




100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 


disp32[EBP] 




101 


85 


8D 


95 


9D 


A5 


AD 


B5 


BD 


disp32[ESI] 




110 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


disp32[EDI] 




111 


87 


8F 


97 


9F 


A7 


AF 


B7 


BF 


EAX/AX/AL 




000 


CO 


C8 


DO 


D8 


E0 


E8 


F0 


F8 


ECX/CX/CL 




001 


C1 


C9 


D1 


D9 


E1 


E9 


F1 


F9 


EDX/DX/DL 




010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


EBX/BX/BL 


11 


011 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


ESP/SP/AH 




100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


FC 


EBP/BP/CH 




101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


ESI/SI/DH 




110 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


EDI/DI/BH 




111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



[- -] [- -] means a SIB follows the ModFI/M byte. disp8 denotes an 8-bit displacement following the SIB byte, to be 
sign-extended and added to the index. disp32 denotes a 32 -bit displacement following the ModR/M byte, to be 
added to the index. 
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Table 4.4 32-bit addressing forms with SIB byte (386 only) 








r32 


EAX 


ECX 


EDX 


EBX 


ESP 


n 


ESI 


EDI 






Base = 





1 


2 


3 


4 


5 


6 


7 






Base = 


000 


001 


010 


011 


100 


101 


110 


111 






Scaled index 


SS index 


ModR/M values 


in hexadecimal 






[EAX] 




000 


00 


01 


02 


03 


04 


05 


06 


07 


[ECX] 




001 


08 


09 


0A 


0B 


OC 


0D 


0E 


OF 


[EDX] 




010 


10 


11 


12 


13 


14 


15 


16 


17 


[EBX] 


00 


011 


18 


19 


1A 


1B 


1C 


1D 


1E 


1F 


none 




100 


20 


21 


22 


23 


24 


25 


26 


27 


[EBP] 




101 


28 


29 


2A 


2B 


2C 


2D 


2E 


2F 


[ESI] 




110 


30 


31 


32 


33 


34 


35 


36 


37 


[EDI] 




111 


38 


39 


3A 


3B 


3C 


3D 


3E 


3F 


[EAX*2] 




000 


40 


41 


42 


44 


44 


45 


46 


47 


[ECX*2] 




001 


48 


49 


4A 


4B 


4C 


4D 


4E 


4F 


[EDX*2] 




010 


50 


51 


52 


55 


54 


55 


56 


57 


[EBX*2] 


01 


011 


58 


59 


5A 


5B 


5C 


5D 


5E 


5F 


none 




100 


60 


\ 61 


62 


63 


64 


65 


66 


67 


[EBP*2] 




101 


68 


69 


6A 


6B 


6C 


6D 


6E 


6F 


[ESI*2] 




110 


70 


71 


72 


73 


74 


75 


76 


77 


[EDP2] 




111 


78 


79 


7A 


7B 


7C 


7D 


7E 


7F 


[EAXM] 




000 


80 


81 


82 


83 


84 


85 


86 


87 


[ECX*4] 




001 


88 


89 


8A 


8B 


8C 


8D 


8E 


8F 


[EDXM] 




010 


90 


91 


92 


93 


94 


95 


96 


97 


[EBX*4] 


10 


011 


98 


89 


9A 


9B 


9C 


9D 


9E 


9F 


none 




100 


A0 


A1 


A2 


A3 


A4 


A5 


A6 


A7 


[EBP*4] 




101 


A8 


A9 


AA 


AB 


AC 


AD 


AE 


AF 


[ESM] 




110 


B0 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


[EDIM] 




111 . 


B8 


B9 


BA 


BB 


BC 


BD 


BE 


BF 


[EAX*8] 




000 


CO 


C1 


C2 


C3 


C4 


C5 


C6 


C7 


[ECX*8] 




001 


C8 


C9 


CA 


CB 


CC 


CD 


CE 


CF 


[EDX*8] 




010 


DO 


D1 


D2 


D3 


D4 


D5 


D6 


D7 


[EBX*8] 


11 


011 


D8 


D9 


DA 


DB 


DC 


DD 


DE 


DF 


none 




100 


E0 


E1 


E2 


E3 


E4 


E5 


E6 


E7 


[EBP*8] 




101 


E8 


E9 


EA 


EB 


EC 


ED 


EE 


EF 


[ESI*8] 




110 


F0 


F1 


F2 


F3 


F4 


F5 


F6 


F7 


[EDI*8] 




111 


F8 


F9 


FA 


FB 


FC 


FD 


FE 


FF 



[*] means a disp32 with no base if MOD is 00; otherwise, [ESP]. 
This provides the following addressing modes: 

disp32[index] (MOD=00) 

disp8[EBP][index] (MOD=01) 

disp32[EBP][index] (MOD=10) 
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How to read the instruction set pages 

Here's a sample of the format of this chapter: 



Instruction What the instruction name means 
name What processor the instruction works on 



ODITSZAPC 
Flag information goes here 

Opcode Instruction Clocks 

386 286* 86 

This table contains clock information 



'Because the 186 processor is effectively a 286 without protected mode instructions, the 186 timings are identical 
to the timings listed for the 286. 



Flags 



Each entry in this section includes information on which flags in the x86's 
flag register are changed and how. Each flag has a one-letter tag for its 
name. 

= Overflow flag Z = Zero flag 

D = Direction flag A = Auxiliary flag 

1 = Interrupt flag P = Parity flag 
T = Trap flag C = Carry flag 
S = Sign flag 

The following symbols indicate how the flag register has changed: 

? = Undefined after the operation 

* = Changed to reflect the results of the instruction 

= Always cleared 

1 = Always set 
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Opcode 

The "Opcode" column gives the complete object code produced for each 
form of the instruction. When possible, the codes are given as hexadeci- 
mal bytes, in the same order in which they appear in memory. Defini- 
tions of entries other than hexadecimal bytes are as follows: 

/digit 

(digit is between and 7.) Indicates that the ModR/M byte of the instruc- 
tion uses only the r/m (register or memory) operand. The reg field con- 
tains the digit that provides an extension to the instruction's opcode. 

It 

Indicates that the ModR/M byte of the instruction contains both a regis- 
ter operand and an r/m operand. 

cb, cw, cd, cp 

A 1-byte (cb), 2-byte (cw), 4-byte (cd), or 6-byte (cp) value following the 
opcode that is used to specify a code offset and possibly a new value for 
the code segment register. 

ib, iw, id 

A 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to the instruc- 
tion that follows the opcode, ModR/M bytes, or scale-indexing bytes. The 
opcode determines if the operand is a signed value. All words and dou- 
blewords are given with the low-order byte first. 

+rb, +rw, +rd 

A register code, from through 7, added to the hexadecimal byte given 
at the left of the plus sign to form a single opcode byte. The codes are 

rb rw rd(386) 



AL = 


AX = 


EAX = 


CL = 1 


CX = 1 


ECX = 1 


DL = 2 


DX = 2 


EDX = 2 


BL=3 


BX = 3 


EBX = 3 


AH = 4 


SP = 4 


ESP = 4 


AH = 4 


SP = 4 


ESP = 4 


CH = 5 


BP = 5 


EBP = 5 


DH = 6 


SI = 6 


ESI = 6 


BH = 7 


DI = 7 


EDI = 7 


Instruction 







The "Instruction" column gives the syntax of the instruction statement as 
it would appear in a TASM 386 program. The following is a list of the 
symbols used to represent operands in the instruction statements: 
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rel8 

A relative address in the range from 128 bytes before the end of the in- 
struction to 127 bytes after the end of the instruction. 

rell6, rel32 

A relative address within the same code segment as the instruction as- 
sembled. rell6 applies to instructions with an operand-size attribute of 16 
bits; rel32 applies to instructions with an operand-size attribute of 32 bits 
(386 only). 

ptrl6:16, ptrl6:32 

A far pointer, typically in a code segment different from that of the in- 
struction. The notation 16:16 indicates that the value of the pointer has 
two parts. The value to the right of the colon is a 16-bit selector or value 
destined for the code segment register. The value to the left corresponds 
to the offset within the destination segment. ptrl6:16 is used when the in- 
struction's operand-size attribute is 16 bits; ptrl6:32 is used with the 32- 
bit attribute (386 only). 

r8 

One of the byte registers AL, CL, DL, BL, AH, CH, DH, or BH. 

rl6 

One of the word registers AX, CX, DX, BX, SP, BP, SI, or DL 

r32 (386) 

One of the doubleword registers EAX, ECX, EDX, EBX, ESP, EBP, ESI, or 

EDI. 

imm8 

An immediate byte value. imm8 is a signed number between -128 and 
+127 inclusive. For instructions in which imm8 is combined with a word 
or doubleword operand, the immediate value is sign-extended to form a 
word or doubleword. The upper byte of the word is filled with the top- 
most bit of the immediate value. 

imml6 

An immediate word value used for instructions whose operand-size at- 
tribute is 16 bits. This is a number between -32,768 and +32,767 inclusive. 

imm32 (386) 

An immediate doubleword value used for instructions whose operand- 
size attribute is 32 bits. It allows the use of a number between 
+2,147,483,647 and -2,147,483,648. 

r/m8 

A 1-byte operand that is either the contents of a byte register (AL, BL, 
CL, DL, AH, BH, CH, DH), or a byte from memory. 

r/ml6 

A word register or memory operand used for instructions whose oper- 
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and-size attribute is 16 bits. The word registers are AX, BX, CX, DX, SP, 
BP, SI, DL The contents of memory are found at the address provided by 
the effective address computation. 

r/m32 

A doubleword register or memory operand used for instructions whose 
operand-size attribute is 32 bits. The doubleword registers are EAX, EBX, 
ECX, EDX, ESP, EBP, ESI, EDI. The contents of memory are found at the 
address provided by the effective address computation. 

m8 

A memory byte addressed by DS:SI or ES:DI (used only by string instruc- 
tions on the 386). 

ml6 

A memory word addressed by DS:SI or ES:DI (used only by string in- 
structions). 

m32 

A memory doubleword addressed by DS:SI or ES:DI (used only by string 
instructions). 

ml6:16, ml6:32 (386) 

A memory operand containing a far pointer composed of two numbers. 
The number to the left of the colon corresponds to the pointer's segment 
selector. The number to the right corresponds to its offset. 

ml6 & 32, ml6 & 16 (186/286/386), m32 & 32 (386) 

A memory operand consisting of data item pairs whose sizes are indi- 
cated on the left and the right side of the ampersand. All memory ad- 
dressing modes are allowed. ml6 & 16 and m32 & 32 operands are used 
by the BOUND instruction to provide an operand containing an upper 
and lower bounds for array indices. ml6 & 32 is used by LIDT and 
LGDT to provide a word with which to load the limit field, and a double- 
word with which to load the base field of the corresponding Global and 
Interrupt Descriptor Table Registers. 

moffs8, moffsl6, moffs32 (memory offset; 386 only) 
A simple memory variable of type BYTE, WORD, or DWORD (386) 
used by some variants of the MOV instruction. The actual address is 
given by a simple offset relative to the segment base. No ModR/M byte 
is used in the instruction. The number shown with moffs indicates its 
size, which is determined by the address-size attribute of the instruction. 

Sreg 

A segment register. The segment register bit assignments are ES = 0, 
CS = 1, SS = 2, DS = 3, FS = 4 (386), and GS = 5 (386). 
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Clocks 

The "Clocks" column gives the number of clock cycles the instruction 
takes to execute. The clock count calculations make the following assump- 
tions: 

■ The instruction has been prefetched and decoded and is ready for exe- 
cution. 

■ Bus cycles do not require wait states. 

■ There are no local bus HOLD requests delaying processor access to the 
bus. 

■ No exceptions are detected during instruction execution. 

■ Memory operands are aligned. 

Clock counts for instructions that have an r/m (register or memory) oper- 
and are separated by a slash. The count to the left is used for a register 
operand; the count to the right is used for a memory operand. 

The following symbols are used in the clock count specifications: 

■ n, which represents a number of repetitions. 

■ m, which represents the number of components in the next instruction 
executed, where the entire displacement (if any) counts as one compo- 
nent, the entire immediate data (if any) counts as one component, and 
every other byte of the instruction and prefix(es) each counts as one 
component. 

■ pm=, a clock count that applies when the instruction executes in pro- 
tected mode. pm= is not given when the clock counts are the same for 
protected and real address modes. 

When an exception occurs during the execution of an instruction and the 
exception handler is in another task, the instruction exception time is in- 
creased by the number of clocks to effect a task switch. This parameter 
depends on several factors: 

■ The type of TSS used to represent the current task (386 TSS or 286 TSS). 

■ The type of TSS used to represent the new task. 

■ Whether the current task is in V86 mode. 

■ Whether the new task is in V86 mode. 

Note: Users should read Intel's documentation for more information 
about protected mode and task switching. 
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AAA ASCII adjust after addition 



Opcode Instruction 




Clocks 




Description 


37 AAA 


486 
3 


386 286 
4 3 


86 
8 


ASCII adjust after addition 



Execute AAA only following an ADD instruction that leaves a byte result 
in the AL register. The lower nibbles of the operands of the ADD instruc- 
tion should be in the range through 9 (BCD digits). In this case, AAA 
adjusts AL to contain the correct decimal digit result. If the addition pro- 
duced a decimal carry, the AH register is incremented, and the carry and 
auxiliary carry flags are set to 1. If there was no decimal carry, the carry 
and auxiliary flags are set to and AH is unchanged. In either case, AL is 
left with its top nibble set to 0. To convert AL to an ASCII result, follow 
the AAA instruction with OR AL, 30H. 



AAD ASCII adjust before division 



Opcode Instruction 


Clocks 




Description 


486 
D5 OA AAD 14 


386 286 
19 14 


86 
60 


ASCII adjust before division 



AAD is used to prepare two unpacked BCD digits (the least-significant 
digit in AL, the most-significant digit in AH) for a division operation that 
will yield an unpacked result. This is accomplished by setting AL to AL 
+ (10 * AH), and then setting AH to 0. AX is then equal to the binary 
equivalent of the original unpacked two-digit number. 



AAM ASCII adjust AX after multiply 



Opcode Instruction Clocks Description 



486 386 286 86 
D4 0A AAM 15 17 16 83 ASCII adjust AX after multiply 

Execute AAM only after executing a MUL instruction between two un- 
packed BCD digits that leaves the result in the AX register. Because the 
result is less than 100, it is contained entirely in the AL register. AAM un- 
packs the AL result by dividing AL by 10, leaving the quotient (most- 
significant digit) in AH and the remainder (least-significant digit) in AL. 
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AAS 



ASCII adjust AL after subtraction 



Opcode 


Instruction 




Clocks 




Description 


3F 


AAS 


486 
3 


386 286 
4 3 


86 
8 


ASCII adjust AL after subtraction 



Execute AAS only after a SUB instruction that leaves the byte result in 
the AL register. The lower nibbles of the operands of the SUB instruction 
must have been in the range through 9 (BCD digits). In this case, AAS 
adjusts AL so it contains the correct decimal digit result. If the subtrac- 
tion produced a decimal carry, the AH register is decremented, and the 
carry and auxiliary carry flags are set to 1. If no decimal carry occurred, 
the carry and auxiliary carry flags are set to 0, and AH is unchanged. In 
either case, AL is left with its top nibble set to 0. To convert AL to an AS- 
CII result, follow the AAS with OR AL, 30H. 



ADC 



Opcode Instruction 



Add with carry 



Clocks 



Description 







486 


386 


286 


86 


10 n 


ADC r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADC r/m16,r16 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADC r/m32,r32 


1/3 


2/7 






12 /r 


ADC r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADCr16,r/m16 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADC r32,r/m32 


1/2 


2/6 






14 I'D 


ADC AL,imm8 


1 


2 


3 


4 


15 iw 


ADCAX,imm16 


1 


2 


3 


4 


15 id 


ADC EAX,imm32 


1 


2 






80 /2 ib 


ADC r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


81 12 iw 


ADC r/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


81 /2 id 


ADC r/m32,imm32 


1/3 


2/7 






83 /2 ib 


ADC r/m16,imm8 


1/3 


211 


3/7 


4/17+EA 


83 12. ib 


ADC r/m32,imm8 


1/3 


211 







Add with carry byte register to r/m byte 

Add with carry word register to r/m word 

Add with CF dword register to r/m word 

Add with carry r/m byte to byte register 

Add with carry r/m word to word register 

Add with CF r/m dword to dword register 

Add with carry immediate byte to AL 

Add with carry immediate word to AX 

Add with carry immediate dword to EAX 

Add with carry immediate byte to r/m byte 

Add with carry immediate word to r/m 

word 

Add with CF immediate dword to r/m 

dword 

Add with CF sign-extended immediate 

byte to r/m word 

Add with CF sign-extended immediate 

byte into r/m dword 



ADC performs an integer addition of the two operands DEST and SRC 
and the carry flag, CF. The result of the addition is assigned to the first 
operand (DEST), and the flags are set accordingly. ADC is usually exe- 
cuted as part of a multi-byte or multi-word addition operation. When an 
immediate byte value is added to a word or doubleword operand, the im- 
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mediate value is first sign-extended to the size of the word or double- 
word operand. 



ADD 



Opcode Instruction 



Add 



Clocks 



Description 







486 


386 


286 


86 


04 ib 


ADD AL,imm8 


1 


2 


3 


4 


05 iw 


ADD AX,imm1 6 


1 


2 


3 


4 


05 id 


ADD EAX,imm32 


1 


2 






80 /0 ib 


ADD r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


81 /0 iw 


ADD r/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


81 /0 id 


ADD r/m32,imm32 


1/3 


2/7 






83 /0 ib 


ADD r/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


83 /0 ib 


ADD r/m32,imm8 


1/3 


2/7 






00 /r 


ADD r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


01 /r 


ADD r/m16,r16 


1/3 


2/7 


2/7 


3/16+EA 


01 /r 


ADD r/m32,r32 


1/3 


2/7 






02 /r 


ADD r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


03 /r 


ADD r16,r/m16 


1/2 


2/6 


2/7 


3/9+EA 


03 /r 


ADD r32,r/m32 


1/2 


2/6 







Add immediate byte to AL 
Add immediate word to AX 
Add immediate dword to EAX 
Add immediate byte to r/m byte 
Add immediate word to r/m word 
Add immediate dword to r/m dword 
Add sign-extended immediate byte 
to r/m word 

Add sign-extended immediate byte 
to r/m dword 

Add byte register to r/m byte 
Add word register to r/m word 
Add dword register to r/m dword 
Add r/m byte to byte register 
Add r/m word to word register 
Add r/m dword to dword register 



ADD performs an integer addition of the two operands (DEST and SRC). 
The result of the addition is' assigned to the first operand (DEST), and the 
flags are set accordingly. 

When an immediate byte is added to a word or doubleword operand, the 
immediate value is sign-extended to the size of the word or doubleword 
operand. 



AND 


Logical AND 










O D 


I T 


S 


Z 


A P C 









* 


* 


? * 


Opcode 


Instruction 


Clocks 






Description 




486 


386 


286 


86 




20 /r 


AND r/m8,r8 1/3 


2/7 


2/7 


3/16+EA 


AND byte register into r/m byte 


21 /r 


ANDr/m16,r16 1/3 


2/7 


2/7 


3/16+EA 


AND word register into r/m word 


21 /r 


AND r/m32,r32 1/3 


2/7 






AND dword register to r/m dword 


22 /r 


AND r8 ; r/m8 1/2 


• 2/6 


2/7 


3/9+EA 


AND r/m byte to byte register 


23 /r 


ANDr16,r/m16 1/2 


2/6 


2/7 


3/9+EA 


AND r/m word to word register 


23 /r 


AND r32,r/m32 1/2 


2/6 






AND r/m dword to dword register 


24 ib 


AND AL,imm8 1 


2 


3 


4 


. AND immediate byte to AL 


25 iw 


ANDAX,imm16 1 


2 


3 


4 


AND immediate word to AX 


25 id 


AND EAX,imm32 1 


2 






AND immediate dword to EAX 
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Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 


80 /4 ib 


AND r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


81 /4 iw 


AND r/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


81 /4 id 


AND r/m32,imm32 


1/3 


2/7 






83 14 ib 


AND r/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


83 /4 ib 


AND r/m32,imm8 


1/3 


2/7 







AND immediate byte to r/m byte 
AND immediate word to r/m word 
AND immediate dword to r/m word 
AND sign-extended immediate byte 
with r/m word 

AND sign-extended immediate byte 
with r/m dword 



Each bit of the result of the AND instruction is a 1 if both corresponding 
bits of the operands are 1; otherwise, it becomes a 0. 

The optimized form of AND is MASKFLAG (see Part 3). 



ARPL 



Adjust RPL field of selector 

80286 and greater protected mode only 



Opcode Instruction 


Clocks Description 


486 
63 /r ARPL r/m 16,r16 9/9 


386 286 

pm=20/21 pm=1 0/1 1 Adjust RPL of r/m1 6 to not less than RPL of r1 6 



The ARPL instruction has two operands. The first operand is a 16-bit 
memory variable or word register that contains the value of a selector. 
The second operand is a word register. If the RPL field ("requested privi- 
lege level" -bottom two bits) of the first operand is less than the RPL 
field of the second operand, the zero flag is set to 1 and the RPL field of 
the first operand is increased to match the second operand. Otherwise, 
the zero flag is set to and no change is made to the first operand. 

ARPL appears in operating system software, not in application programs. 
It is used to guarantee that a selector parameter to a subroutine does not 
request more privilege than the caller is allowed. The second operand of 
ARPL is normally a register that contains the CS selector value of the 
caller. 



BOUND 



Check array index against bounds 
80186 processors and greater 



Opcode Instruction 



Clocks 



Description 





486 


386 


286 


62 /r 


BOUND r1 6, 7 7 


10 


13 


62 /r 


BOUNDr32,7 7 


10 





Check if r16 is within m16&1 6 bounds (passes test) 
Check if r32 is within m32&32 bounds (passes test) 
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BOUND ensures that a signed array index is within the limits specified 
by a block of memory consisting of an upper and a lower bound. Each 
bound uses one word for an operand-size attribute of 16 bits and a dou- 
bleword for an operand-size attribute of 32 bits. The first operand (a regis- 
ter) must be greater than or equal to the first bound in memory (lower 
bound), and less than or equal to the second bound in memory (upper 
bound). If the register is not within bounds, an Interrupt 5 occurs; the re- 
turn EIP points to the BOUND instruction. 

The bounds limit data structure is usually placed just before the array it- 
self, making the limits addressable via a constant offset from the begin- 
ning of the array. 



BSF Bit scan forward 

386 processors and greater 



Opcode Instruction Clocks Description 







486 386 




OFBC 


BSF r1 6,r/m16 


6-42/7-43 10+3n 


Bit scan forward on r/m word 


OFBC 


BSF r32,r/m32 


10+3n 


Bit scan forward on r/m dword 



BSF scans the bits in the second word or doubleword operand starting 
with bit 0. The ZF flag is cleared if the bits are all 0; otherwise, the ZF 
flag is set and the destination register is loaded with the bit index of the 
first set bit. 



BSR Bit scan reverse 

386 processors and greater 



Opcode Instruction Clocks Description 





486 


386 




OFBD 


BSRr16,r/m16 6-103/7-104 


10+3n 


Bit scan reverse on r/m word 


OFBD 


BSR r32,r/m32 6-103/7-104 


10+3n 


Bit scan reverse on r/m dword 



BSR scans the bits in the second word or doubleword operand from the 
most significant bit to the least significant bit. The ZF flag is cleared if the 
bits are all 0; otherwise, ZF is set and the destination register is loaded 
with the bit index of the first set bit found when scanning in the reverse 
direction. 
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BSWAP Byte Swap 

i486 processors and greater 



Opcode Instruction Clock Description 



486 
OF C8/r BSWAP r32 1 Swap bytes to convert little/big endian data in a 32-bit register to big/little 

endian form. 

BSWAP reverses the byte order of a 32-bit register, converting a value in 
little/big endian form to big/little endian form. When BSWAP is used 
with a 16-bit operand size, the result left in the destination register is un- 
defined. 



BT Bit test 

386 processors and greater 



Opcode Instruction Clocks Description 







486 


386 




OF A3 


BTr/m16,r16 


3/8 


3/12. 


Save bit in carry flag 


OF A3 


BT r/m32,r32 


3/8 


3/12 


Save bit in carry flag 


OF BA /4 ib 


BTr/m16,imm8 


3/3 


3/6 


Save bit in carry flag 


OF BA /4 ib 


BT r/m32,imm8 


3/3 


3/6 


Save bit in carry flag 



BT saves the value of the bit indicated by the base (first operand) and the 
bit offset (second operand) into the carry flag. 



BTC Bit test and complement 

386 processors and greater 



Opcode Instruction Clocks Description 

Save bit in carry flag and complement 
Save bit in carry flag and complement 
Save bit in carry flag and complement 
Save bit in carry flag and complement 

BTC saves the value of the bit indicated by the base (first operand) and 
the bit offset (second operand) into the carry flag and then complements 
the bit. 
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486 


386 


OFBB 


BTC r/m16,r16 


6/13 


6/13 


OFBB 


BTC r/m32,r32 


6/13 


6/13 


OF BA n ib 


BTC r/m16,imm8 


6/8 


6/8 


OF BA f! ib 


BTC r/m32,imm8 


6/8 


6/8 



BTR 



Bit test and reset 

386 processors and greater 



Opcode 



Instruction 



Clocks Description 







486 


386 




0FB3 


BTR r/m16,r16 


6/13 


6/13 


Save bit in carry flag and reset 


0FB3 


BTR r/m32,r32 


6/13 


6/13 


Save bit in carry flag and reset 


OF BA /6 ib 


BTR r/m16,imm8 


6/8 


6/8 


Save bit in carry flag and reset 


OF BA /6 ib 


BTR r/m32,imm8 


6/8 


6/8 


Save bit in carry flag and reset 



BTR saves the value of the bit indicated by the base (first operand) and 
the bit offset (second operand) into the carry flag and then stores in the 
bit. 



BTS 



Bit test and set 

386 processors and greater 



Opcode Instruction 



Clocks Description 



OFAB 
OFAB 
OF BA /5 ib 
OF BA /5 ib 



BTS r/m16,r16 
BTS r/m32,r32 
BTSr/m16,imm8 
BTS r/m32,imm8 



486 

6/13 

6/13 

6/8 6/8 

6/8 6/8 



386 
6/13 
6/13 



Save bit in carry flag and set 
Save bit in carry flag and set 
Save bit in carry flag and set 
Save bit in carry flag and set 



BTS saves the value of the bit indicated by the base (first operand) and 
the bit offset (second operand) into the carry flag and then stores 1 in the 
bit. 



CALL 



Call Procedure 



O.DIT S Z A P C 



All flags are affected if a task switch occurs; no flags are affected if a task 
switch does not occur. 



Opcode Instruction 



Clocks 



Description 







486 


386 


286* 


E8cw 


CALLrel16 


3 


7+m 


7 


FF/2 


CALLr/m16 


5/5 


7+m/10+m 


7/1.1 



19 Call near, displacement 

relative to next instruction 

16/21+EA Call near, register 

indirect/memory indirect 
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Opcode Instruction 



486 386 286* 86 

9Acd CALL ptr16:16 18,pm=20 17+m,pm=34=m 13,pm=26 28 

9Acd CALLptr16:16 pm=35 pm=52+m 41 

9Acd CALL ptr16:16 pm=69 pm=86+m 



9Acd CALL ptr16:16 pm=77+4x pm=94+4x+m 86+4x 

9Acd CALLptr16:16 pm=37+ts ts 177/182 

FF/3 CALLm16:16 17,pm=20 22+m,pm38+m 16/29 37+EA 

FF/3 CALLm16:16 pm=35 pm=56+m 44 

FF/3 CALLm16:16 pm=69 pm=90+m 83 

FF/3 CALL m 16:1 6 pm=77+4x pm=98+4x+m 90+4x+m 

FF/3 CALLm16:16 pm=37+ts 5 + ts 180/185 



E8 cd CALL rel32 
FF 12 CALL 



7+m 

7+m/,vT„, 
,pm=20 17+m,pm=34+m 

pm=52+m 
pm=86+m 



FF/2 CALLr/m32 5/5 7+m/10+m 

9Acp CALLptr16:32 18,pm=20 17+m,pm=: 

9Acp CALL ptrl 6:32 

9Acp CALL ptrl 6:32 

9Acp CALL ptr32:32 pm=77+4x pm=94+4x+m 

9Acp CALL ptrl 6:32 pm=37+ts ts 

FF/3 CALLm16:32 17,pm=20 22+m,pm=38+m 

FF/3 CALL m 16:32 pm=35 pm=56+m 

FF/3 CALLm16:32 pm=69 pm=90+m 

FF/3 CALLm16:32 pm=77+4x pm=98+4x+m 

FF/3 CALLm16:32 pm=37+ts 5 + ts 

*Add one clock for each byte in the next instruction executed 



Description 

Call intersegment, to full 

pointer given 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

x parameters 

Call to task (via task 

state segment/task gate 

for 286 

Call intersegment, 

address at r/m dword 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

x parameters 

Call to task (via task 

state segment/task gate 

for 286) 

Call near, displacement 

relative to next instruction 

Call near, indirect 

Call intersegment, to full 

pointer given 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

x parameters 

Call to task 

Call intersegment, 

address at r/m dword 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

x parameters 

Call to task 



(80286 only). 



The CALL instruction causes the procedure named in the operand to be 
executed. When the procedure is complete (a return instruction is exe- 
cuted within the procedure), execution continues at the instruction that 
follows the CALL instruction. 

The action of the different forms of the instruction are described next. 

Near calls are those with destinations of type r/ml6, r/m.32, rell6, rel32; 
changing or saving the segment register value is not necessary. The 
CALL rell6 and CALL rel32 forms add a signed offset to the address of 
the instruction following CALL to determine the destination. The rell6 
form is used when the instruction's operand-size attribute is 16 bits; rel32 
is used when the operand-size attribute is 32 bits. The result is stored in 
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the 32-bit EIP register. With rel 16, the upper 16 bits of EIP are cleared, re- 
sulting in an offset whose value does not exceed 16 bits. CALL r/ml6 
and CALL r/m32 specify a register or memory location from which the 
absolute segment offset is fetched. The offset fetched from r/m is 32 bits 
for an operand-size attribute of 32 (r/m32), or 16 bits for an operand-size 
of 16 (r/ml6). The offset of the instruction following CALL is pushed 
onto the stack. It will be popped by a near RET instruction within the pro- 
cedure. The CS register is not changed by this form of CALL. 

The far calls, CALL ptrl6:16 and CALL ptrl6:32, use a 4-byte or 6-byte op- 
erand as a long pointer to the procedure called. The CALL ml6:16 and 
ml 6:32 forms fetch the long pointer from the memory location specified 
(indirection). In real address mode or virtual 8086 mode, the long pointer 
provides 16 bits for the CS register and 16 or 32 bits for the EIP register 
(depending on the operand-size attribute). These forms of the instruction 
push both CS and IP or EIP as a return address. 

In protected mode, both long pointer forms consult the AR byte in the de- 
scriptor indexed by the selector part of the long pointer. Depending on 
the value of the AR byte, the call will perform one of the following types 
of control transfers: 

■ a far call to the same protection level 

■ an inter-protection level far call 

■ a task switch 

Note: Turbo Assembler extends the syntax of the CALL instruction to fa- 
cilitate parameter passing to high-level language routines. See Chapter 7 
of the Turbo Assembler User's Guide for more details. 



CBW Convert byte to word 

O D I T S/Z A PC 

Opcode Instruction Clocks Description 

486 386 286 86 
98 CBW 3 3 2 2 AX sign-extend of AL ___ 

CBW converts the signed byte in AL to a signed word in AX by extend- 
ing the most significant bit of AL (the sign bit) into all of the bits of AH. 
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CDQ Convert doubleword to quadword 

386 processors and greater 



Opcode Instruction Clocks Description 



486 386 
99 CDQ 3 2 EDX:EAX [(sign-extend of EAX) 

CDQ converts the signed doubleword in EAX to a signed 64-bit integer 
in the register pair EDX:EAX by extending the most significant bit of 
EAX (the sign bit) into all the bits of EDX. 



CLC Clear carry flag 



T S Z A P C 




Opcode Instruction Clocks 



486 386 286 86 

F8 CLC 2 2 2 2 



CLC sets the carry flag to zero. It does not affect other flags or registers. 

CLD Clear direction flag 

ODITSZAPC 




Opcode Instruction 




Clocks 




Description 


C CLD 


486 
2 


386 286 
2 2 


86 
2 


Clear direction flag 



CLD clears the direction flag. No other flags or registers are affected. Af- 
ter CLD is executed, string operations will increment the index registers 
(SI or DI) that they use. 

CLI Clear interrupt flag 

ODITSZAPC 


Opcode Instruction Clocks 

486 386 286 86 
FA CLI 5 3 3 2 
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CLI clears the interrupt flag if the current privilege level is at least as 
privileged as IOPL. No other flags are affected. External interrupts are 
not recognized at the end of the CLI instruction or from that point on un- 
til the interrupt flag is set. 



CLTS Clear task switched flag 

80286 and greater protected mode only 

ODITSZAPC 

TS = (TS is in CRO, not the flag register) 

Opcode Instruction Clocks 

486 386 286 
OF 06 CLTS 7 5 2 

CLTS clears the task-switched (TS) flag in register CRO. This flag is set by 
the 386 every time a task switch occurs. The TS flag is used to manage 
processor extensions as follows: 

■ Every execution of an ESC instruction is trapped if the TS flag if set. 

■ Execution of a WAIT instruction is trapped if the MP flag and the TS 
flag are both set. 

Thus, if a task switch was made after an ESC instruction was begun, the 
processor extension's context may need to be saved before a new ESC in- 
struction can be issued. The fault handler saves the context and resets the 
TS flag. 

CLTS appears in operating system software, not in application programs. 
It is a privileged instruction that can only be executed at privilege level 0. 

CMC Complement carry flag 



Opcode Instruction 


Clocks 




Description 


486 
F5 CMC 2 


386 286 
2 2 


86 
2 


Complement carry flag 



CMC reverses the setting of the carry flag. No other flags are affected. 
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CMP 



Opcode Instruction 



Compare two operands 



Clocks 



Description 







486 


386 


286 


86 


3Cib 


CMP AL,imm8 


1 


2 


3 


4 


3Diw 


CMPAX,imm16 


1 


2 


3 


4 


3D id 


CMP EAX,imm32 


1 


2 






80/7ib 


CMP r/m8,imm8 


1/2 


2/5 


3/6 


4/10+EA 


81/7 iw 


CMPr/m16,imm16 


1/2 


2/5 


3/6 


4/10+EA 


81 H id 


CMP r/m32,imm32 


1/2 


2/5 






83 17 ib 


CMP r/m16,imm8 


1/2 


2/5 


3/6 


4/10+EA 


83 n ib 


CMP r/m32,imm8 


1/2 


2/5 






38 /r 


CMP r/m8,r8 


1/2 


2/5 


2/7 


3/9+EA 


39 /r 


CMP r/m16,r16 


1/2 


2/5 


2/7 


3/9+EA 


39 /r 


CMP r/m32,r32 


1/2 


2/5 






3A/r 


CMP r8,r/m8 


1/2 


2/6 


2/6 


3/9+EA 


3B/r 


CMPr16,r/m8 


1/2 


2/6 


2/6 


3/9+EA 


3B/r 


CMP r32,r/m32 


1/2 


2/6 







Compare immediate byte to AL 
Compare immediate word from AX 
Compare immediate dword to EAX 
Compare immediate byte to r/m byte 
Compare immediate word to r/m word 
Compare immediate dword to r/m dword 
Compare sign extended immediate byte 
to r/m word 

Compare sign extended immediate byte 
to r/m dword 

Compare byte register to r/m byte 
Compare word register to r/m word 
Compare dword register to r/m dword 
Compare r/m byte to byte register 
Compare r/m word to word register 
Compare r/m dword to dword register 



CMP subtracts the second operand from the first but, unlike the SUB in- 
struction, does not store the result; only the flags are changed. CMP is 
typically used in conjunction with conditional jumps and the SETcc in- 
struction. If an operand greater than one byte is compared to an immedi- 
ate byte, the byte value is first sign-extended. 



CMPS 
CMPSB 
CMPSW 
CMPSD 



Compare string operands 

CMPSD 386 processors and greater 



Opcode Instruction 



Clocks 



Description 



A6 

A7 

A7 

A6 
A7 
A7 



486 



CMPS m8,m8 8 



CMPSm16,m16 8 

CMPSm32,m32 8 

CMPSB 8 

CMPSW 8 

CMPSD 8 



386 

10 

10 

10 

10 
10 
10 



286 86 
8 22 



22 



22 
22 



Compare bytes ES:[(E)DI] (second operand) 
with E(E)SI} (first operand) 

Compare words ES:[(E)DI] (second operand) 

with [(E)SI] (first operand) 

Compare dwords ES:[(E)DI] (second operand) 

with [(E)SI] (first operand) 

Compare bytes ES:[(E)DI] with DS:[SI] 

Compare words ES:[(E)DI] with DS:[SI] 

Compare dwords ES:[(E)DI] with DS:[SI] 



CMPS compares the byte, word/or doubleword pointed to by the source- 
index register with the byte, word, or doubleword pointed to by the desti- 
nation-index register. 
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If the address-size attribute of this instruction is 16 bits, SI and DI will be 
used for source- and destination-index registers; otherwise ESI and EDI 
will be used. Load the correct index values into SI and DI (or ESI and 
EDI) before executing CMPS. 

The comparison is done by subtracting the operand indexed by the desti- 
nation-index register from the operand indexed by the source-index regis- 
ter. 

Note that the direction of subtraction for CMPS is [SI] - [DI] or [ESI] - 
[EDI]. The left operand (SI or ESI) is the source and the right operand (DI 
or EDI) is the destination. This is the reverse of the usual Intel convention 
in which the left operand is the destination and the right operand is the 
source. 

The result of the subtraction is not stored; only the flags reflect the 
change. The types of the operands determine whether bytes, words, or 
doublewords are compared. For the first operand (SI or ESI), the DS regis- 
ter is used, unless a segment override byte is present. The second oper- 
and (DI or EDI) must be addressable from the ES register; no segment 
override is possible. 

After the comparison is made, both the source-index register and destina- 
tion-index register are automatically advanced. If the direction flag is 
(CLD was executed), the registers increment; if the direction flag is 1 
(STD was executed), the registers decrement. The registers increment or 
decrement by 1 if a byte is compared, by 2 if a word is compared, or by 4 
if a doubleword is compared. 

CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and dou- 
bleword CMPS instructions, respectively. 

CMPS can be preceded by the REPE or REPNE prefix for block compari- 
son of CX or ECX bytes, words, or doublewords. Refer to the description 
of the REP instruction for more information on this operation. 



CMPXCHG Compare and Exchange 

i486 processors and greater 



Opcode Instruction 



Clock 



Description 



OFBO/r CMPXCHG r/m8,r8 



OF B1/r CMPXCHG r/m16,M6 



486 , 

6/7 if comparison is 
successful; 6/10 if 
comparison fails 
6/7 if comparison is 
successful; 6/10 if 
comparison fails 



Compare AL with r/m byte. If equal, set ZF and 
load byte reg into r/m byte. Else, clear ZF and 
load r/m byte into AL. 

Compare AX with r/m word. If equal, set ZF 
and load word reg into r/m word. Else, clear ZF 
and load r/m word into AX. 
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Opcode Instruction Clock Description 



486 

OF B1/r CMPXCHG r/m32,r32 6/7 if comparison is Compare EAX with r/m dword. If equal, set ZF 

successful; 6/10 if and load dword reg into r/m dword. Else, clear 

comparison fails ZF and load r/m dword into EAX. 

Note: The A-stepping of the i486 used the opcodes OF A6 and OF A7. 

The CMPXCHG instruction compares the accumulator (AL, AX, or EAX 
register) with DEST. If they are equal, SRC is loaded into DEST. Other- 
wise, DEST is loaded into the accumulator. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable seg- 
ment; #GP(0) for an illegal memory operand effective address in the CS, 
DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS seg- 
ment; #PF (fault code) for a page fault; #AC for an unaligned memory ref- 
erence if the current privilege level is 3. 

Real mode exception: interrupt 13 if any part of the operand would lie 
outside the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: interrupt 13, as in real mode; #PF and 
#AC, as in protected mode. 

Note: This instruction can be used with a LOCK prefix. In order to sim- 
plify interface to the processor's bus, the destination operand receives a 
write cycle without regard to the result of the comparison. DEST is writ- 
ten back if the comparison fails, and SRC is written into the destination 
otherwise. (The processor never produces a locked read without produc- 
ing a locked write.) 

CHPXCHG8B Compare and Exchange 8 bytes 
Pentium processors and greater 



Opcode 


Instruction 


Clocks 


Description 


0FC7 


CMPXCHG64 r/m64 


Pentium 
10 


compare EDX:EAX with r/m qword. If equal, 
set ZF and load ECX:EBX into r/m qword. 
Else, clear ZF and load r/m into EDX:EAX. 



The CMPXCHG8B instruction compares the 64-bit value in EDX:EAX 
with DEST. EDX contains the high-order 32 bits and EAX contains the 
low-order 32 bits of the 64-bit value. If they are equal, the 64-bit value in 
ECX:EBX is stored into DEST. ECX contains the high-order 32 bits and 
EBX contains the low-order 32 bits. Otherwise, DEST is loaded into 
EDX:EAX. 
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The ZF flag is set if the destination operand and EDX:EAX are equal; oth- 
erwise it is cleared. The CF, PF, AF, SF, and OF flags are unaffected. 

Protected mode excpetions: #GP(0) if the result is in a nonwritable seg- 
ment; #GP(0) for an illegal memory operand effective address in the CS, 
DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS seg- 
ment; #PF(fault code) for a page fault; # AC for unaligned memory refer- 
ence if the current privlege level is 3. 

The destination operand must be a memory operand, hot a register. If 
the CMPXCHG8B instruction is executed with a modr/m byte repre- 
senting a register as the destination operand, #UD occurs. 

Real mode exception: interrupt 13 if any part of the operand would lie 
outside the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: same exceptions as in real mode, plus 
#PF (fault code) for a page fault; #AC for unalligned memory reference if 
the current privilage level is 3. #UD if the modr/m byte represents a reg- 
ister as the destination. 

Notes: this instruction can be used with a LOCK prefix. In order to sim- 
plify interface to the processor's bus, the destination operand receives a 
write cycle without regard to the result of the comparison. DEST is writ- 
ten back if the comparison fails, and SRC is written into the destination 
otherwise. (The processor never produces a locked read without also pro- 
ducing a locked write.) 

The "r/m.64" syntax had previously been used only in the context of float- 
ing point operations. It indicates a 64-bit value, in memory at an ad- 
dress determined by the modr/m byte. 



CPUID CPU identification 

Pentium processors and greater 



Opcode 


Instruction 


Clocks 


Description 


0FA2 


CPUID 


Pentium 
14 


EAX <- CPOU identification info. 



The CPUID instruction provides information to software about the ven- 
dor, family, model, and stepping of microprocessor on which it is execut- 
ing. An input value loaded into the EAX register for this instruction indi- 
cates what information should be returned by the CPUID instruction. 

Following execution of the CPUID instruction with a zero in EAX, the 
EAX register contains the highest input value understood by the CPUID 
instruction. For the Pentium processor, the value in EAX will be one. 
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Also returned is a vender identification string contained in the EBX, EDX, 
and ECX registers. EBX contains the first four characters. For Intel proc- 
essors, the vender identification string is "Genuinelntel" as follors: 

EBX - 756e6547h (* "Genu", with 'G' in the low nibble of BL '*) 
EDX - 49656e69h (* "inel", with T in the low nibble of DL *) 
ECX -- 6c65746eh (* "ntel", with 'n' in the low nibble of CI/*) 

Following execution of the CPUID instruction with an input value of one 
loaded into the EAX register, bits 0-3 in EAX contain the stepping id of 
the microprocessor, bits 4-7 of EAX contain the model (the first model 
will be indicated by a 0001b in these bits) and bits 8-11 of EAX contain 
the family (5 for the Pentium processor family). Bits 12-31 of EAX are re- 
served, as well as EBX, and ECX. The Pentium processor sets the feature 
register, EDX, to lbfh, indicating which features the Pentium processor 
supports. A feature flag set to one indicates that the corresponding fea- 
ture is supported. The feature set is defined as follows: 

EDX (bit 0) FPU on chip 

EDX (bits 1-6) Non-essential, proprietary information (contact Intel 

for more information) 
EDX (bit 7) Machine Check Exception 

EDX (bit 8) CMPXCHG8B Instruction 

EDX (bits 9-31) Reserved 

Software should determine the vender identification in order to properly 
interpret the feature register flag bits. 

This function does not affect the CPU flags. 



CWD Convert word to doubleword 

386 processors and greater 



Opcode Instruction 


Clocks 




Description 


486 
99 CWD 3 


386 286 
2 2 


86 
5 


DX:AX <r- sign-extend of AX 



CWD converts the signed word in AX to a signed doubleword in DX AX 
by extending the most significant bit of AX into all the bits of DX. Note 
that CWD is different from CWDE. CWDE uses EAX as a destination, in- 
stead of DX:AX. 
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CWDE Convert word to doubleword 

386 processors and greater 



Opcode Instruction 


Clocks 




Description 


486 
98 CWDE 3 


386 286 
3 


86 


EAX <- sign-extend of AX 



CWDE converts the signed word in AX to a doubleword in EAX by ex- 
tending the most significant bit of AX into the two most significant bytes 
of EAX. Note that CWDE is different from CWD. CWD uses DX:AX 
rather than EAX as a destination. 



DAA Decimal adjust AL after addition 



Opcode 


Instruction 


Clocks 




Description 


27 


486 
DAA 2 


386 286 
4 3 


86 
4 


Decimal adjust AL after addition 



Execute DAA only after executing an ADD instruction that leaves a two- 
BCD-digit byte result in the AL register. The ADD operands should con- 
sist of two packed BCD digits. The DAA instruction adjusts AL to con- 
tain the correct two-digit packed decimal result. 



DAS Decimal adjust AL after subtraction 



Opcode Instruction 




Clocks 




Description 


2F DAS 


486 
2 


386 286 
4 3 


86 
4 


Decimal adjust AL after subtraction 



Execute DAS only after a subtraction instruction that leaves a two-BCD- 
digit byte result in the AL register. The operands should consist of two 
packed BCD digits. DAS adjusts AL to contain the correct packed two- 
digit decimal result. 
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DEC 



Opcode Instruction 



Decrement by 1 



Clocks 



Description 



FE/1 
FF/1 

48+rw 
48+rw 


DEC r/m8 
DECr/m16 
DEC r/m32 
DEC r16 
DEC r32 


486 

1/3 

1/3 

1/3 

1 

1 


386 

2/6 

2/6 

2/6 

2 

2 


286 

2/7 
2/7 

2 


86 

3/15+EA Decrement r/m byte by 1 

3/15+EA Decrement r/m word by 1 

Decrement r/m dword by 1 
3 Decrement word register by 1 

Decrement dword register by 1 



DEC subtracts 1 from the operand. DEC does not change the carry flag. 
To affect the carry flag, use the SUB instruction with an immediate oper- 
and of 1. 



DIV 



Unsigned divide 



Opcode Instruction 






Clocks 




Description 




486 


386 


286 


86 




F6 /6 DIV r/m8 


16/16 


14/17 


14/17 


80/86+EA 


Unsigned divide AX by r/m byte 
(AL=QUO, AH=REM) 


F7/6 DIV r/m 16 


24/24 


22/25 


22/25 


144/154+EA 


Unsigned divide DX:AX by r/m word 
(AX=QUO, DX=REM) 


F7/6 DIVr/m32 


40/40 


38/41 






Unsigned divide EDX:EAX by r/m dword 
(EAX=QUO, EDX=REM) 



DIV performs an unsigned division. The dividend is implicit; only the di- 
visor is given as an operand. The remainder is always less than the divi- 
sor. The type of the divisor determines which registers to use as follows: 



Size 


Dividend 


Divisor 


Quotient 


Remainder 


byte 


AX 


r/m8 


AL 


AH 


word 


DX:AX , 


r/m 16 


AX 


DX 


dword 


EDX:EAX 


r/m32 


EAX 


EDX (386 only) 



ENTER Make stack frame for procedure parameters 

80186 processors and greater 



Opcode Instruction 



Clocks 



Description 



C8iw00 Enter imml 6,0 



486 386 
14 10 



286 

11 



Make procedure stack frame 
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Opcode Instruction Clocks Description 



C8 
C8 


iw 01 

iwib 


Enter imml 6,1 
Enter imm16,imm8 


486 

17 
17+3n 


386 

12 
15+4(n-1) 


286 

15 

12+4(n 


■1) 


Make stack frame for procedure parameters 
Make stack frame for procedure parameters 



ENTER creates the stack frame required by most block-structured high- 
level languages. The first operand specifies the number of bytes of dy- 
namic storage allocated on the stack for the routine being entered. The 
second operand gives the lexical nesting level (0 to 31) of the routine 
within the high-level language source code. It determines the number of 
stack frame pointers copied into the new stack frame from the preceding 
frame. BP (or EBP, if the operand-size attribute is 32 bits) is the current 
stack frame pointer. 

If the operand-size attribute is 16 bits, the processor uses BP as the frame 
pointer and SP as the stack pointer. If the operand-size attribute is 32 bits, 
the processor uses EBP for the frame pointer and ESP for the stack 
pointer. 

If the second operand is 0, ENTER pushes the frame pointer (BP or EBP) 
onto the stack; ENTER then subtracts the first operand from the stack 
pointer and sets the frame pointer to the current stack-pointer value. 

For example, a procedure with 12 bytes of local variables would have an 
ENTER 12,0 instruction at its entry point and a LEAVE instruction before 
every RET. The 12 local bytes would be addressed as negative offsets 
from the frame pointer. 



HLT Halt 



ODITSZAPC 



Opcode 


Instruction 


Clocks 




Description 


F4 


486 
HLT 4 


386 286 
5 2 


86 
2 


Halt 



HLT stops instruction execution and places the x86 in a HALT state. An 
enabled interrupt, NMI, or a reset will resume execution. If an interrupt 
(including NMI) is used to resume execution after HLT, the saved CS:IP 
(or CS:EIP on an 386) value points to the instruction following HLT. 
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IDIV Signed divide 



Opcode 


Instruction 




Clocks 


Description 






486 


386 286 86 




F6/7 


IDIV r/m8 


19/20 


19 17/20 101-112/107-118+EA 


Signed divide AX by r/m byte 
(AL=QUO, AH=REM) 


F7/7 


IDIV r/m16 


27/28 


27 25/28 165-184/171 -190+EA 


Signed divide DX:AX by EA word 
(AX=QUO, DX=REM) 


F7/7 


IDIV r/m32 


43/44 


43 


Signed divide EDX:EAX by DWORD 
byte (EAX=QUO, EDX=REM) 



IDIV performs a signed division. The dividend, quotient, and remainder 
are implicitly allocated to fixed registers. Only the divisor is given as an 
explicit r/m operand. The type of the divisor determines which registers 
to use as follows: 



Size 


Divisor 


Quotient 


Remainder 


Dividend 


byte 


r/m8 


AL 


AH 


AX 


word 


r/m16 


AX 


DX 


DX:AX 


dword 


r/m32 


EAX 


EDX 


EDX:EAX (386 only) 



If the resulting quotient is too large to fit in the destination, or if the divi- 
sion is 0, an Interrupt is generated. Nonintegral quotients are truncated 
toward 0. The remainder has the same sign as the dividend and the abso- 
lute value of the remainder is always less than the absolute value of the 
divisor. 



IMUL Signed multiply 



Opcode Instruction Clocks Description 

486 386 286 86 

F6/5 IMULr/m8 13-18/13-18 9-14/12-17 13/16 80-98/86-1 04 AX <h-AL * r/m byte 

+EA 
F7/5 IMULr/m16 1 3-26/1 3-26 9-22/1 2-25 21/24 128-154/134- DX:AX <-AX * r/m word 

160+EA 
F7 /5 IMUL r/m32 1 2-42/1 3-42 9-38/1 2-41 EDX:EAX <-EAX* r/m dword 

OFAF/r IMUL r16,r/m16 13-26/13-26 9-22/12-25 word register <— word register * 

r/m word 
OFAF/r IMUL r32,r/m32 13-42/13-42 9-38/12-41 dword register <-dword register 

* r/m dword 
6B/rib IMUL r16,r/ 13-26/13-26 9-14/12-17 21/24 word register <-r/m1 6 * 

m16,imm8 sign-extended immediate byte 

6B/rib IMUL r32,r/ 13-42 9-14/12-17 dword register <r-r/m32 * 

m32,imm8 sign-extended immediate byte 

6B/rib IMULr16,imm8 13-26 9-14/12-17 21/24 word register <-word register * 

sign-extended immediate byte 
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Opcode Instruction 



Clocks 



Description 



386 286 86 

9-14/12-17 



6B/rib IMUL r32,imm8 13-42 

13-26/13-26 9-22/12-25 21/24 
13-42/13-42 9-38/12-41 



69/riw IMULr16,r/ 

m16,imm16 
69 /r id IMUL r32,r/ 

m32,imm32 
69/riw IMULr16,imm16 13-26/13-26 9-22/12-25 



69 /rid IMUL r32,imm32 13-42/13-42 9-38/12-41 



dword register <-dword register 
* sign-extended immediate byte 
word register <-r/m1 6 
immediate word 
dword register r/m32 * 
immediate dword 
word register <-r/m1 6* 
immediate word 
dword register <-r/m32 * 
immediate dword 



IMUL performs signed multiplication. Some forms of the instruction use 
implicit register operands. The operand combinations for all forms of the 
instruction are shown in the "Description" column above. 

IMUL clears the overflow and carry flags under the following conditions: 



Instruction form 

r/m.8 

r/ml6 

r/m32 

rl6,r/ml6 

r32,r/m32 

rl6,r/ml6,imml6 

r32 / r/m32 / imm32 



Condition for clearing CF and OF 

AL = sign-extend of AL to 16 bits 

AX = sign-extend of AX to 32 bits 

EDX:EAX = sign-extend of EAX to 32 bits 

Result exactly fits within rl6 

Result exactly fits within r32 

Result exactly fits within rl6 

Result exactly fits within r32 



IN 



Opcode Instruction 



Input from port 



s Z A P c 



Clocks 



486 386 

E4ib INAL,imm8 14,pm=8728**,vm=27 12,pm=6726* 

E5ib INAX,imm8 14,pm=8728**,vm=27 12,pm=6726* 

E5ib INEAX,imm8 14,pm=8728**,vm=27 12,pm=6726* 

EC INAL.DX 14,pm=8728**,vm=27 13,pm=7727* 

ED INAX.DX 14,pm=8728*>m=27 13,pm=7727* 

ED INEAX.DX 14,pm=8728**,vm=27 13,pm=7727* 

*lf CPL < IOPL 

"If CPL > IOPL or if in virtual 8086 mode 



286 86 



5 
5 

5 


10 
10 

8 


Input byte from 
immediate port into AL 
Input word from 
immediate port into AX 
Input dword from 
immediate port into EAX 
Input byte from port DX 
intoAL 


5 


8 


Input word from port DX 
into AX 

Input dword from port 
DX into EAX 



IN transfers a data byte or data word from the port numbered by the sec- 
ond operand into the register (AL, AX, or EAX) specified by the first oper- 
and. Access any port from to 65535 by placing the port number in the 
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DX register and using an IN instruction with DX as the second param- 
eter. These I/O instructions can be shortened by using an 8-bit port I/O 
in the instruction. The upper eight bits of the port address will be when 
8-bit port I/O is used. 



INC 



Opcode Instruction 



Increment by 1 



Clocks 



Description 







486 


386 


286 


86 




FE/0 


INC r/m8 


1/3 


2/6 


2/7 


3/15+EA 


Increment r/m byte by 1 


FF/0 


INCr/m16 


1/3 


2/6 


2/7 


3/15+EA 


Increment r/m word by 1 


FF/6 


INC r/m32 


1/3 








Increment r/m dword by 1 


40+ rw 


INC r16 


1 


2 


2 


3 


Increment word register by 1 


40+ rd 


INC r32 


1 








Increment dword register by 1 



INC adds 1 to the operand. It does not change the carry flag. To affect the 
carry flag, use the ADD instruction with a second operand of 1. 



INS 
INSB 
INSW 
INSD 

Opcode Instruction 



Input from port to string 
80186 processors and greater 



Clocks 



Description 



486 386 286 

6C INS r/m8,DX 17,pm=10732**,vm=30 15,pm=9729** 5 

6D INSr/m16,DX 17,pm=10732**,vm=30 15,pm=9729** 5 

6D INSr/m32,DX 17,pm=10732",vm=30 15,pm=9729" 

6C INSB 17,pm=10732",vm=30 15,pm=9729** 5 

6D INSW 17,pm=10732**,vm=30 15,pm=9729** 5 

6D INSD 17,pm=10732**,vm=30 15,pm=9729" 

*lf CPL < I0PL 

**lf CPL > IOPL or if in virtual 8086 mode 



Input byte from port 
DX into ES:(E)DI 
Input word from port 
DX into ES:(E)DI 
Input dword from 
port DX into ES:(E)DI 
Input byte from port 
DX into ES:(E)DI 
Input word from port 
DX into ES:(E)DI 
Input dword from 
port DX into ES:(E)DI 



INS transfers data from the input port numbered by the DX register to 
the memory byte or word at ES:dest-index. The memory operand must 
be addressable from ES; no segment override is possible. The destination 
register is DI if the address-size attribute of the instruction is 16 bits, or 
EDI if the address-size attribute is 32 bits. 
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INS does not allow the specification of the port number as an immediate 
value. The port must be addressed through the DX register value. Load 
the correct value into DX before executing the INS instruction. 

The destination address is determined by the contents of the destination 
index register. Load the correct index into the destination index register 
before executing INS. 

After the transfer is made, DI or EDI advances automatically. If the direc- 
tion flag is (CLD was executed), DI or EDI increments; if the direction 
flag is 1 (STD was executed), DI or EDI decrements. DI increments or dec- 
rements by 1 if a byte is input, by 2 if a word is input, or by 4 if a double- 
word is input. 

INSB, INSW and INSD are synonyms of the byte, word, and doubleword 
INS instructions. INS can be preceded by the REP prefix for block input 
of CX bytes or words. Refer to the REP instruction for details of this op- 
eration. 



INT 
INTO 




Call to interrupt procedure 




















O D 


I T 



s z 


A E 


* C 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




CC 


INT3 


26 


33 


23 


52 


Interrupt 3-trap to debugger 


CC 


INT3 


44 


pm=59 


40 




Interrupt 3-protected mode 


CC 


INT3 


71 


pm=99 


78 




Interrupt 3-protected mode 


CC 


INT3 


82 


pm=119 






Interrupt 3-from V86 mode to 
PLO 


CC 


INT3 


37+ts 


ts 


167 




Interrupt 3-protected mode 


CD ib 


INTimm8 


30 


37 


23 


51 


Interrupt numbered by 
immediate byte 


CD ib 


INTimm8 


44 


pm=59 


40 




Interrupt-protected mode 


CD ib 


INTimm8 


77 


pm=99 


78 




Interrupt-protected mode 


CD ib 


INTimm8 


86 


pm=119 






Interrupt-from V86 mode to PLO 


CD ib 


INTimm8 


37+tS 


ts 


167 




Interrupt-protected mode 


CE 


INTO 


Pass:28, 


Fail:3, pm=3; 


Fail:3, 


Fail:4, 


Interrupt 4— if overflow flag is 1 






Fail:3 


Pass:35 


Pass:24 


Pass:53 




CE 


INTO 


46 


pm=59 


41 




Interrupt 4-Protected mode 


CE 


INTO 


73 ' 


pm=99 


79 




Interrupt 4-Protected mode 


CE 


INTO 


84 


pm=119 






Interrupt 4-from V86 mode to 
PLO 


CE 


INTO 


39+ts 


ts 


168 




Interrupt 4-Protected mode 


* Add one clock for each byte of the i 


next instruction executed (80286 only). 





The INT n instruction generates via software a call to an interrupt han- 
dler. The immediate operand, from to 255, gives the index number into 
the interrupt descriptor table (IDT) of the interrupt routine to be called. 
In protected mode, the IDT consists of an array of eight-byte descriptors; 
the descriptor for the interrupt invoked must indicate an interrupt, trap, 
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or task gate. In real address mode, the IDT is an array of four byte-long 
pointers. In protected and real address modes, the base linear address of 
the IDT is defined by the contents of the IDTR. 

The INTO conditional software instruction is identical to the INT n inter- 
rupt instruction except that the interrupt number is implicitly 4, and the 
interrupt is made if the 86, 286, or 386 overflow flag is set. 

The first 32 interrupts are reserved by Intel for system use. Some of these 
interrupts are use for internally generated exceptions. 

INT n generally behaves like a far call except that the flags register is 
pushed onto the stack before the return address. Interrupt procedures re- 
turn via the IRET instruction, which pops the flags and return address 
from the stack. 

In real address mode, INT n pushes the flags, CS and the return IP onto 
the stack, in that order, then jumps to the long pointer indexed by the in- 
terrupt number. 



INVD 



Invalidate cache 

i486 processors and greater 



Opcode Instruction Clock Description 



OF 08 



INVD 



486 
4 



Invalidate entire cache 



The internal cache is flushed, and a special-function bus cycle is issued 
which indicates that external caches should also be flushed. Data held in 
write-back external caches is discarded. 

Note: This instruction is implementation-dependent; its function might 
be implemented differently on future Intel processors. 

It is the responsibility of hardware to respond to the external cache flush 
indication. 



INVLPG 



Invalidate TLB entry 

i486 processors and greater 



Opcode Instruction Clock 



Description 



486 
OF 01/7 INVLPG m 12 for hit Invalidate TLB entry 
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The INVLPG instruction is used to invalidate a single entry in the TLB, 
the cache used for table entries. If the TLB contains a valid entry that 
maps the address of the memory operand, that TLB entry is marked inva- 
lid. 

In both protected mode and virtual 8086 mode, an invalid opcode is gen- 
erated when used with a register operand. 

Note: This instruction is implementation-dependent; its function might 
be implemented differently on future Intel processors. 



IRET Interrupt return 

IRETD IRETD 386 processors and greater 
IRETW 



The flags register is popped from stack. 

Opcode Instruction Clocks Description 

~86 

32 Interrupt return (far return and pop flags) 
Interrupt return 
Interrupt return 

Interrupt return (far return and pop flags) 
Interrupt return to lesser privilege 
Interrupt return to V86 mode 
Interrupt return 

Selects IRETW or IRETD depending on 
segment size of 16 or 32 bits. Only 
works for VERSION T320 or higher. 

* Add one clock, for each byte in the next instruction executed (80286 only). 

In real address mode, IRET pops the instruction pointer, CS, and the flags 
register from the stack and resumes the interrupted routine. 

In protected mode, the action of IRET depends on the setting of the 
nested task flag (NT) bit in the flag register. When popping the new flag 
image from the stack, the IOPL bits in the flag register are changed only 
when CPL equals 0. 

If NT equals 0, IRET returns from an interrupt procedure Without a task 
switch. The code returned to must be equally or less privileged than the 
interrupt routine (as indicated by the RPL bits of the CS selector popped 
from the stack). If the destination code is less privileged, IRET also pops 
the stack pointer and SS from the stack. 

If NT equals 1, IRET reverses the operation of a CALL or INT that caused 
a task switch. The updated state of the task executing IRET is saved in its 
task state segment. If the task is re-entered later, the code that follows 
IRET is executed. 
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486 


386 


286 


CF 


IRETW 


15 


22,pm=38 


17,pm=31 


CF 


IRETW 


36 


pm=82 


55 


CF 


IRETW 


ts+32 


ts 


169 


CF 


IRETD 


15 


22,pm=38 




CF 


IRETD 


36 


pm=82 




CF 


IRETD 


15 


pm=60 




CF 


IRETD 


ts+32 


ts 




CF 


IRET 









IRETW pops WORD-style (if you use VERSION T320 or higher). If you're 
using VERSION T310 or less, use IRET; IRETW replaces old functionality 
of IRET. 



Jcc 



Jump if condition is met 



D I T 



Z A P C 



Opcode 



Instruction 



Clocks 



Description 







486 


386 


286 


86 




77 cb 


JA rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if above (CF=0 and ZF=0) 


73 cb 


JAE rel8 


3/1 


7+m+,3 


7,3 


16,4 


Jump short if above or equal (CF=0) 


72 cb 


JB rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if below (CF=1) 


76 cb 


JBE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if below or equal (CF=1 or 
ZF=1) 


72 cb 


JC rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if carry (CF=1) 


E3cb 


JCXZ rel8 


3/1 


9+m,5 


8,4 


18,6 


Jump short if CX register is 


E3cb 


JECXZrel8 


3/1 


9+m,5 






Jump short if ECX register is 


74 cb 


JE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if equal (ZF=1) 


74 cb 


JZ rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if 0(ZF=1) 


7Fcb 


JG rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if greater (ZF=0 and SF=OF) 


7Dcb 


JGE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if greater or equal (SF=OF) 


7Ccb 


JL rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if less (SFoOF) 


7Ecb 


JLE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if less or equal (ZF=1 and 
SFoOF) 


76 cb 


JNA rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not above (CF=1 or ZF=1) 


72 cb 


JNAE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not above or equal (CF=1) 


73 cb 


JNB rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not below (CF=0) 


77 cb 


JNBE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not below or equal (CF=0 
and ZF=0) 


73 cb 


JNC rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not carry (CF=0) 


75 cb 


JNE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not equal (ZF=0) 


7Ecb 


JNG rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not greater (ZF=1 or 
SFoOF) 


7Ccb 


JNGE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not greater or equal 
(SFoOF) 


7Dcb 


JNL rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not less (SF=OF) 


7Fcb 


JNLE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not less or equal (ZF=0 and 
SF=OF) 


71 cb 


JNO rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not overflow (OF=0) 


7Bcb 


JNP rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not parity (PF=0) 


79 cb 


JNS rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not sign (SF=0) 


75 cb 


JNZ rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if not zero (ZF=0) 


70 cb 


JO rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if overflow (OF=1 ) 


7Acb 


JP rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity (PF=1) 


7Acb 


JPE rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity even (PF=1) 


7Bcb 


JPO rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if parity odd (PF=0) 


78 cb 


JS rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short if sign (SF=1) 


74 cb 


JZ rel8 


3/1 


7+m,3 


7,3 


16,4 


Jump short of zero (ZF=1) 


OF 87 cw/cd 


JA rell 6/32 


3/1 


7+m,3 






Jump near if above (CF=0 and ZF=0) 


OF 83 cw/cd 


JAE rell 6/32 


3/1 


7+m,3 






Jump near if above or equal (CF=0) 


OF 82 cw/cd 


JBrel16/32 


3/1 


7+m,3 






Jump near if below (CF=1) 


OF 86 cw/cd 


JBE rell 6/32 


3/1 


7+m,3 






Jump near if below or equal (CF=1or ZF=1) 


OF 82 cw/cd 


JC rel16/32 


3/1 


7+m,3 






Jump near if carry (CF=1) 


OF 84 cw/cd 


JE rel16/32 


3/1 


7+m,3 






Jump near if equal (ZF=1) 
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Opcode 



Instruction 



Clocks 



Description 







486 


386 


OF 84 cw/cd 


JZrel16/32 


3/1 


7+m,3 


OF 8F cw/cd 


JG reM 6/32 


3/1 


7+m,3 


OF 8D cw/cd 


JGE rell 6/32 


3/1 


7+m,3 


OF 8C cw/cd 


JLrel16/32 


3/1 


7+m,3 


OF 8E cw/cd 


JLE rel16/32 


3/1 


7+m,3 


OF 86cw/cd 


JNA rell 6/32 


3/1 


7+m,3 


OF 82 cw/cd 


JNAE rel16/32 


3/1 


7+m,3 


OF 83 cw/cd 


JNB rel16/32 


3/1 


7+m,3 


OF 87 cw/cd 


JNBE rell 6/32 


3/1 


7+m,3 


OF 83 cw/cd 


JNC rell 6/32 


3/1 


7+m,3 


OF 85 cw/cd 


JNErel16/32 


3/1 


7+m,3 


OF 8E cw/cd 


JNG rel16/32 


3/1 


7+m,3 


OF 8C cw/cd 


JNGE rel16/32 


3/1 


7+m,3 


OF 8D cw/cd 


JNL rel16/32 


3/1 


7+m,3 


OF 8F cw/cd 


JNLE rel16/32 


3/1 


7+m,3 


OF 81 cw/cd 


JNO rel16/32 


3/1 


7+m,3 


OF 8B cw/cd 


JNPrel16/32 


3/1 


7+m,3 


OF 89 cw/cd 


JNS rell 6/32 


3/1 


7+m,3 


OF 85 cw/cd 


JNZ reM 6/32 


3/1 


7+m,3 


OF 80 cw/cd 


JO rell 6/32 


3/1 


7+m,3 


OF 8A cw/cd 


JPrel16/32 


3/1 


7+m,3 


OF 8A cw/cd 


JPE rell 6/32 


3/1 


7+m,3 


OF 8B cw/cd 


JPOrel16/32 


3/1 


7+m,3 


OF 88 cw/cd 


JS reM 6/32 


3/1 


7+m,3 


OF 84 cw/cd 


JZrel16/32 


3/1 


7+m,3 



286 86 



Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
SFoOF) 
Jump near 
Jump near 
Jump near 
Jump near 
and ZF=0 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
SF=OF) 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 
Jump near 



if0(ZF=1) 

if greater (ZF=0 and SF=OF) 

if greater or equal (SF=OF) 

if less (SFoOF) 

if less or equal(ZF=1 and 

if not above (CF=1 or ZF=1 ) 
if not above or equal (CF=1) 
if not below (CF=0) 
if not below or equal (CF=0 

if not carry and ZF=0) 

if not equal (ZF=0) 

if not greater (ZF=1 or SFoOF) 

if not greater or equal (SFoOF) 

if not less (SF=OF) 

if not less or equal (ZF=0 and 

if not overflow (OF=0) 
if not parity (PF=0) 
if not sign (SF=0) 
if not zero (ZF=0) 
if overflow (OF=1) 
if parity (PF=1) 
if parity even (PF=1 ) 
if parity odd (PF=0) 
if sign (SF=1) 
if zero (ZF=1 ) 



* When a jump is taken, add one clock for every byte of the next instruction executed (80286 only). 

Note: The first clock count is for the true condition (branch taken); the 
second clock count is for the false condition (branch not taken). rell6/32 
indicates that these instructions map to two; one with a 16-bit relative dis- 
placement, the other with a 32-bit relative displacement, depending on 
the operand-size attribute of the instruction. 

Conditional jumps (except JCXZ/JECXZ) test the flags which have been 
set by a previous instruction. The conditions for each mnemonic are 
given in parentheses after each description above. The terms "less" and 
"greater" are used for comparisons of signed integers; "above" and "be- 
low" are used for unsigned integers. 

If the given condition is true, a jump is made to the location provided as 
the operand. Instruction coding is most efficient when the target for the 
conditional jump is in the current code segment and within -128 to + 127 
bytes of the next instruction's first byte. The jump can also target -32768 
through +32767 (segment size attribute 16) or -2 to the 31st power +2 to 
the 31st power -1 (segment size attribute 32) relative to the next instruc- 
tion's first byte. When the target for the conditional jump is in a different 
segment, use the opposite case of the jump instruction (that is, JE and 
JNE), and then access the target with an unconditional far jump to the 
other segment. For example, you cannot code 
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JZ FARLABEL; 

You must instead code 

JNZ BEYOND; 
JMP FARLABEL; 
BEYOND: 

Because there can be several ways to interpret a particular state of the 
flags, TASM provides more than one mnemonic for most of the condi- 
tional jump opcodes. For example, if you compared two characters in AX 
and want to jump if they are equal, use JE; or, if you ANDed AX with a 
bit field mask and only want to jump if the result is 0, use JZ, a synonym 
for JE. 

JCXZ/JECXZ differs from other conditional jumps because it tests the 
contents of the CX or ECX register for 0, not the flags. JCXZ/JECXZ is 
useful at the beginning of a conditional loop that terminates with a condi- 
tional loop instruction (such as LOOPNE TARGET LABEL). The 
JCXZ/JECXZ prevents entering the loop with CX or ECX equal to zero, 
which would cause the loop to execute 64K or 32G times instead of zero 
times. 



JMP 



Jump 



All if a task switch takes place; none if no task switch occurs 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




EBcb 


JMP rel8 


3 


7+m 


7 


15 


Jump short 


E9cw 


JMP rel16 


3 


7+m 


7 


15 


Jump near 


FF/4 


JMPr/m16 


5/5 


7+m/1 0+m 


7/11 


11/18+EA 


Jump near indirect 


EAcd 


JMP ptr16:16 


17pm=19 


12+m,pm=27+m 


11,pm=23 


15 


Jump intersegment, 4-byte 
immediate address 


EAcd 


JMPptr16:16 


32 


pm=45+m 


38 




Jump to call gate, same 
privilege 


EAcd 


JMPptr16:16 


42+ts 


ts 


175 




Jump via task state 
■segment 


EAcd 


JMP ptr16:16 


43+ts 


ts 


180 


24+EA 


Jump via task gate 


FF/5 


JMPm16:16 


13,pm=18 


43+m,pm=31+m 


15,pm=26 




Jump r/m16:16 indirect 
and intersegment 


FF/5 


JMPm16:16 


31 


pm=49+m 


41 




Jump to call gate, same 
privilege 


FF/5 


JMPm16:16 


41+ts 


5+ts 


178 




Jump via task state 
segment 


FF/5 


JMP m16:16 


42+ts 


5+ts 


183 




Jump via task gate 


E9cd 


JMP rel32 


3 


7+m 






Jump near 


FF/4 


JMP r/m32 


5/5 


7+m, 1 0+m 






Jump near 


EAcp 


JMP ptrl 6:32 


13,pm=18 


12+m, pm=27+m 






Jump intersegment, 6-byte 
immediate address 
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Opcode Instruction 




Clocks 


EAcp JMPptr16:32 


486 
31 


386 
pm=45+m 


EAcp JMP ptr16:32 


42+ts 


ts 



Description 



286 



Jump to call gate, same 

privilege 

Jump via task state 

segment 

EAcp JMP ptrl 6:32 43+ts ts Jump via task gate 

FF/5 JMPm16:32 13,pm=18 43+m, pm=31+m Jump intersegment 

address at r/m dword 

FF/5 JMPm16:32 31 pm=49+m Jump to call gate, same 

privilege 

FF/5 JMP m 16:32 41+ts 5 + ts Jump via task state 

segment 

FF/5 JMP m 16:32 42+ts 5 + ts Jump via task gate 

* Add one clock for every byte of the next instruction executed (80286 only). 

The JMP instruction transfers control to a different point in the instruc- 
tion stream without recording return information. 

The action of the various forms of the instruction are shown below. 

Jumps with destinations of type r/ml6, r/m32, rell6, and rel32 are near 
jumps and do not involve changing the segment register value. 

The JMP rell6 and JMP rel32 forms of the instruction add an offset to the 
address of the instruction following the JMP to determine the destination. 
The rell6 form is used when the instruction's operand-size attribute is 16 
bits (segment size attribute 16 only); rel32 is used when the operand-size 
attribute is 32 bits (segment size attribute 32 only). The result is stored in 
the 32-bit EIP register. With rell6, the upper 16 bits of EIP are cleared, 
which results in an offset whose value does not exceed 16 bits. 

JMP r/ml6 and JMP r/m32 specifies a register or memory location from 
which the absolute offset from the procedure is fetched. The offset 
fetched from r/m is 32 bits for an operand-size attribute of 32 bits 
(r/m32), or 16 bits for an operand-size attribute of 16 bits (r/ml6). 

The JMP ptrl6:16 and ptrl6:32 forms of the instruction use a four-byte or 
six-byte operand as a long pointer to the destination. The JMP ml6:16 
and ml 6:32 forms fetch the long pointer from the memory location speci- 
fied (indirection). In real address mode or virtual 8086 mode, the long 
pointer provides 16 bits for the CS register and 16 or 32 bits for the EIP 
register (depending on the operand-size attribute). In protected mode, 
both long pointer forms consult the access rights (AR) byte in the descrip- 
tor indexed by the selector part of the long pointer. Depending on the 
value of the AR byte, the jump will perform one of the following types of 
control transfers: 

■ a jump to a code segment at the same privilege level 

■ a task switch 
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LAHF Loads flags into AH register 



Opcode 


Instruction 


Clocks 




Description 


9F 


486 
LAHF 3 


386 286 
2 2 


86 

4 


Load: AH = flags SF ZF xx AF xx PF xx CF 



LAHF transfers the low byte of the flags word to AH. The bits, from MSB 
to LSB, are sign, zero, indeterminate, auxiliary carry, indeterminate, par- 
ity, indeterminate, and carry. 



LAR Load access rights byte 

80286 and greater protected mode only 



Opcode Instruction Clocks Description 







486 386 


286 


OF 02/r 


LARr16,r/m16 


11/11 pm=15/16 


1 4/1 6 r1 6<-r/m 1 6 masked by FFOO 


OF 02 /r 


LAR r32,r/m32 


11/11 pm=15/16 


r32<-r/m32 masked by OOFxFFOO 



The LAR instruction stores a marked form of the second doubleword of 
the descriptor for the source selector if the selector is visible at the CPL 
(modified by the selector's RPL) and is a valid descriptor type. The desti- 
nation register is loaded with the high-order doubleword of the descrip- 
tor masked by OOFxFFOO, and ZF is set to 1. The x indicates that the four 
bits corresponding to the upper four bits of the limit are undefined in the 
value loaded by LAR. If the selector is invisible or of the wrong type, ZF 
is cleared. 

If the 32-bit operand size is specified, the entire 32-bit value is loaded 
into the 32-bit destination register. If the 16-bit operand size is specified, 
the lower 16-bits of this value are stored in the 16-bit destination register. 

All code and data segment descriptors are valid for LAR. (See your Intel 
manual for valid segment and gate descriptor types for LAR.) 



LEA Load effective address offset 



ODITSZAPC 



Opcode Instruction Clocks Description 

486 386 286 86 
8D/r LEAr16,m 1 2 3 2+EA Store effective address for m in register r1 6 

8D/r LEA r32,m 1 2 Store effective address for m in register r32 
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Opcode 


Instruction 




Clocks 




Description 


8D/r 
8D/r 


LEA r16,m 
LEA r32,m 


486 
1 

1 


386 286 

2 

2 


86 


Store effective address for m in register r16 
Store effective address for m in register r32 



LEA calculates the effective address (offset part) and stores it in the speci- 
fied register. The operand-size attribute of the instruction is determined 
by the chosen register. The address-size attribute is determined by the 
USE attribute of the segment containing the second operand. The address- 
size and operand-size attributes affect the action performed by LEA, as 
follows: 

Operand Address Action 
size size performed 

16 16 16-bit effective address is calculated and stored 

in requested 16-bit register destination. 

16 32 32-bit effective address is calculated. The lower 

16 bits of the address are stored in the requested 
16-bit register destination. 

32 16 16-bit effective address is calculated. The 16-bit 

address is zero-extended and stored in the re- 
quested 32-bit register destination. 

32 32 32-bit effective address is calculated and stored in 

the requested 32-bit register destination. 



LEAVE 



High-level procedure exit 
80186 processors and greater 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 




C9 


LEAVE 


5 


4 


5 


Set SP to BP 


C9 


LEAVE 


5 


4 




Set ESP to EBP 



LEAVE reverses the actions of the ENTER instruction. By copying the 
frame pointer to the stack pointer, LEAVE releases the stack space used 
by a procedure for its local variables. The old frame pointer is popped 
into BP or EBP, restoring the caller's frame. A subsequent RET nn instruc- 
tion removes any arguments pushed onto the stack of the exiting proce- 
dure. 
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LGDT/LIDT Load global/interrupt descriptor table register 
80286 and greater protected mode only 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


OF 01 11 


LGDTm16&32 


11 


11 


11 


OF 01 /3 


LIDT m16&32 


11 


11 


12 



Load m into global descriptor table register 
Load m into interrupt descriptor table register 



The LGDT and LIDT instructions load a linear base address and limit 
value from a six-byte data operand in memory into the GDTR or IDTR, 
respectively. If a 16-bit operand is used with LGDT or LIDT, the register 
is loaded with a 16-bit limit and a 24-bit base, and the high-order 8 bits of 
the 6-byte data operand are not used. If a 32-bit operand is used, a 16-bit 
limit and a 32-bit base is loaded; the high-order 8 bits of the 6-byte oper- 
and are used as high-order base address bits. 

The SGDT and SIDT instructions always store into all 48 bits of the 6- 
byte data operand. With the 80286, the upper 8 bits are undefined after 
SGDT or SIDT is executed. With the 386, the upper 8 bits are written with 
the high-order 8 address bits, for both a 16-bit operand and a 32-bit oper- 
and. If LGDT or LIDT is used with a 16-bit operand to load the register 
stored by SGDT or SIDT, the upper 8 bits are stored as zeros. 

LGDT and LIDT appear in operating system software; they are not used 
in application programs. They are the only instructions that directly load 
a linear address (i.e., not a segment relative address) in 386 protected 
mode. 



LGS 


Load full pointer 






LSS 


LGS/LSS/LFS 386 processors and greater 


LFS 


























LDS 





D 


I T 


s 


Z A 


P C 


LES 














Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




C5/r 


LDS r16,m1 6:16 


6/12 


7,pm=22 


7,pm=21 


16+EA 


Load DS:r1 6 with pointer from memory 


C5/r 


LDS r32,m1 6:32 


6/12 


7,pm=22 






Load DS:r32 with pointer from memory 


OF B2 /r 


LSSr16,m16:16 


6/12 


7,pm=22 






Load SS:r16 with pointer from memory 


OF B2 /r 


LSS r32,m1 6:32 


6/12 


7,pm=22 






Load SS:r32 with pointer from memory 


C4/r 


LESr16,m16:16 


6/12 


7,pm=22 


7,pm=21 


16+EA 


Load ES:r16 with pointer from memory 


C4/r 


LES r32,m1 6:32 


6/12 


7,pm=22 






Load ES:r32 with pointer from memory 


OF B4 It 


LFSr16,m16:16 


6/12 


7,pm=25 






Load FS:r1 6 with pointer from memory 


OF B4 It 


LFS r32,m1 6:32 


6/12 


7,pm=25 






Load FS:r32 with pointer from memory 


OF B5 It 


LGS r16,m16:16 


6/12 


7,pm=25 






Load GS:r16 with pointer from memory 


OF B5 It 


LGS r32,m16:32 


6/12 


7,pm=25 






Load GS:r32 with pointer from memory 
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These instructions read a full pointer from memory and store it in the se- 
lected segment register: register pair. The full pointer loads 16 bits into 
the segment register SS, DS, ES, FS, or GS. The other register loads 32 bits 
if the operand-size attribute is 32 bits, or loads 16 bits if the operand-size 
attribute is 16 bits. The other 16- or 32-bit register to be loaded is deter- 
mined by the rl6 or r32 register operand specified. 

When an assignment is made to one of the segment registers, the de-scrip- 
tor is also loaded into the segment register. The data for the register is ob- 
tained from the descriptor table entry for the selector given. 

A null selector (values 0000-0003) can be loaded into DS, ES, FS, or GS 
registers without causing a protection exception. (Any subsequent refer- 
ence to a segment whose corresponding segment register is loaded with a 
null selector to address memory causes a #GP(0) exception. No memory 
reference to the segment occurs.) 



LLDT Load local descriptor table register 

80286 and greater protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00 /2 


LLDTr/m 16 


486 

11/11 


386 
20 


286 

17/19 


Load selector r/m16 into LDTR 



LLDT loads the local descriptor table register (LDTR). The word operand 
(memory or register) to LLDT should contain a selector to the global de- 
scriptor table (GDT). The GDT entry should be a local descriptor table. If 
so, then the LDTR is loaded from the entry. The descriptor registers DS, 
ES, SS, FS, GS, and CS are not affected. The LDT field in the task state 
segment does not change. 

The selector operand can be 0; if so, the LDTR is marked invalid. All de- 
scriptor references (except by the LAR, VERR, VERW or LSL instructions) 
cause a #GP fault. 

LLDT is used in operating system software; it is not used in application 
programs. 
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LMSW 



Load machine status word 

80286 and greater protected mode only 



Opcode 


Instruction 


Clocks 


Description 


OF 01 /6 


LMSWr/m16 


486 386 286 
13/13 10/13 3/6 


Load r/m 16 into machine status word 



LMSW loads the machine status word (part of CRO) from the source oper- 
and. This instruction can be used to switch to protected mode; if so, it 
must be followed by an intrasegment jump to flush the instruction 
queue. LMSW will not switch back to real address mode. 

LMSW is used only in operating system software. It is not used in appli- 
cation programs. 



LOCK 



Assert LOCK# signal prefix 



Opcode 


Instruction 


Clocks 




Description 


F0 


486 
LOCK 1 


386 286 



86 
2 


Assert LOCK* signal for the next instruction 



The LOCK prefix causes the LOCK# signal of the CPU to be asserted dur- 
ing execution of the instruction that follows it. In a multiprocessor envi- 
ronment, this signal can be used to ensure that the CPU has exclusive use 
of any shared memory while LOCK# is asserted. The read-modify- write 
sequence typically used to implement test-and-set on the 386 is the BTS 
instruction. 

On the 386 and i486, the LOCK prefix functions only with the following 
instructions: 



BT, BTS, BTR, BTC 

XCHG 

XCHG 

ADD, OR, ADC, SBB, 

AND, SUB, XOR 

NOT, NEG, INC, DEC 



mem, reg/imm 
reg, mem 
mem, reg 
mem reg/imm 



mem 



An undefined opcode trap will be generated if a LOCK prefix is used 
with any instruction not listed above. 

XCHG always asserts LOCK # regardless of the presence or absence of 
the LOCK prefix. 
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The integrity of the LOCK is not affected by the alignment of the mem- 
ory field. Memory locking is observed for arbitrarily misaligned fields. 

Locked access is not assured if another CPU processor is executing an in- 
struction concurrently that has one of the following characteristics: 

■ Is not preceded by a LOCK prefix. 

■ Is not one of the instructions in the preceding list. 

■ Specifies a memory operand that does not exactly overlap the destina- 
tion operand. Locking is not guaranteed for partial overlap, even if one 
memory operand is wholly contained within another. 

LODS Load string operand 

LODSB LODSD 386 processors and greater 

LODSW 

LODSD ODITSZAPC 

Opcode Instruction Clocks Description 

486 386 286 86 

AC L0DSm18 5 5 5 12 Load byte [(E)SI] into AL 

AD L0DSm16 5 5 5 12 Load word [(E)SI] into AX 

AD LODSm32 5 5 Load dword [(E)SI] into EAX 

AC LODSB 5 5 5 12 Load byte DS:[(E)SI] into AL 

AD LODSW 5 5 5 12 Load word DS:[(E)SI] into AX 

AD L0DSD5 5 Load dword DS:[(E)SI] into EAX 

LODS loads the AL, AX, or EAX register with the memory byte, word, or 
doubleword at the location pointed to by the source-index register. After 
the transfer is made, the source-index register is automatically advanced. 
If the direction flag is (CLD was executed), the source index increments; 
if the direction flag is 1 (STD was executed), it decrements. The increment 
or decrement is 1 if a byte is loaded, 2 if a word is loaded, or 4 if a dou- 
bleword is loaded. 

If the address-size attribute for this instruction is 16 bits, SI is used for 
the source-index register; otherwise the address-size attribute is 32 bits, 
and the ESI register is used. The address of the source data is determined 
solely by the contents of ESI /SI. Load the correct index value into SI be- 
fore executing the LODS instruction. LODSB, LODSW, LODSD are syno- 
nyms for the byte, word, and doubleword LODS instructions. 

LODS can be preceded by the REP prefix; however, LODS is used more 
typically within a LOOP construct, because further processing of the data 
moved into EAX, AX, or AL is usually necessary. 
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LOOP Loop control with CX counter 

LOOPcond Loop control with CX/ECX counter 
386 processors and greater 



Opcode Instruction Clocks Description 







486 


386 


286 


86 


E2cb 


LOOP rel8 


2,6 


11+m 


8,noj=4 


17,noj=5 


E1 cb 


LOOPE rel8 


9,6 


11+m 


8,noj=4 


18,noj=6 


E1cb 


LOOPZ relS 


9,6 


11+m 


8,noj=4 


18,noj=6 


EOcb 


LOOPNE rel8 


9,6 


11+m 


8,noj=4 


19,noj=5 


EOcb 


LOOPNZ rel8 


9,6 


11+m 


8,noj=4 


19,noj=5 



DEC Count; jump short if Count 
DEC Count; jump short if Count and ZF=1 
DEC Count; jump short if Count and ZF=1 
DEC Count; jump short if Count and ZF=0 
DEC Count; jump short if Count and ZF=0 



LOOP decrements the count register without changing any of the flags. 
Conditions are then checked for the form of LOOP being used. If the con- 
ditions are met, a short jump is made to the label given by the operand to 
LOOP. If the address-size attribute is 16 bits, the CX register is used as 
the count register; otherwise the ECX register is used (386 only). The oper- 
and of LOOP must be in the range from 128 (decimal) bytes before the in- 
struction to 127 bytes ahead of the instruction. 

The LOOP instructions provide iteration control and combine loop index 
management with conditional branching. Use the LOOP instruction by 
loading an unsigned iteration count into the count register, then code the 
LOOP at the end of a series of instructions to be iterated. The destination 
of LOOP is a label that points to the beginning of the iteration. 



LSL Load segment limit 

80286 and greater protected mode only 



Opcode Instruction Clocks Description 

486 386 286 " ~ 

OF 03 /r LSL r16,r/m16 10/10 pm=20/21 14/16 Load: r16<— segment limit, selector r/m16 

(byte granular) 
OF 03 /r LSLr32,r/m32 10/10 pm=20/21 Load: r32<-segment limit, segment limit, 

selector r/m32 (byte granular) 
OF 03 /r LSL r16,r/m16 10/10 pm=25/26 14/16 Load: r16<— segment limit, segment limit, 

selector r/m1 6 (page granular) 
OF 03 /r LSL r32,r/m32 10/10 pm=26/26 Load: r32<-segment limit selector r/m32 
(page granular) 

The LSL instruction loads a register with an unscrambled segment limit, 
and sets ZF to 1, provided that the source selector is visible at the CPL 
weakened by RPL, and that the descriptor is a type accepted by LSL. Oth- 
erwise, ZF is cleared to 0, and the destination register is unchanged. The 
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segment limit is loaded as a byte granular value. If the descriptor has a 
page granular segment limit, LSL will translate it to a byte limit before 
loading it in the destination register (shift left 12 the 20-bit "raw" limit 
from descriptor, then OR with 00000FFFH). 

The 32-bit forms of this instruction store the 32-bit byte granular limit in 
the 16-bit destination register. 

Code and data segment descriptors are valid for LSL. 



LTR 



Load task register 

80286 and greater protected mode only 

O D I T S Z A P C 



Opcode 


Instruction 




Clocks 




Description 


OF 00 /3 


LTRr/m16 


486 
20/20 


386 
pm=23/27 


286 

17/19 


Load EA word into task register 



LTR loads the task register from the source register or memory location 
specified by the operand. The loaded task state segment is marked busy. 
A task switch does not occur. 

LTR is used only in operating system software; it is not used in applica- 
tion programs. 



MOV 



Move data 



ODITSZAPC 



Opcode Instruction 



Clocks 



Description 





486 


386 


286 


86 




88 /r 


MOV r/m8,r8 1 


2/2 


2/3 - 


2/9+EA 


Move byte register into r/m byte 


89 /r 


MOVr/m16,r16 1 


2/2 


2/3 


2/9+EA 


Move word register into r/m word 


89 /r 


MOV r/m32,r32 1 


2/2 






Move dword register to r/m dword 


8A/r 


MOV r8,r/m8 1 


2/4 


2/5 


2/8+EA 


Move r/m byte into byte register 


8B/r 


MOVr16,r/m16 1 


'2/4 


2/5 


2/8+EA 


Move r/m word into word register 


8B/r 


MOV r32,r/m32 1 


2/4 






Move r/m dword into dword register 


8C/r 


MOVr/m16,Sreg 3/3 


2/2 


2/3 


2/9+EA 


Move segment register to r/m register 


8D/r 


MOVSreg,r/m16 3/9 


2/5,pm 
1/198 


= 2/5,pm= 
17/19 


= 2/8+EA 


Move r/m word to segment register 


A0 


MOV AL,moffs8 1 


4 


5 


10 


Move byte at (seg:offset) to AX 


A1 


MOV AX,moffs16 1 


4 


5 


10 


Move word at (seg:offset) to AX 


A1 


MOV EAX,moffs32 1 


4 






Move dword at (seg:offset) to EAX 


A2 


MOV moffs8,AL 1 


4 


3 


10 


Move AL to (seg:offset) 


A3 


MOVmoffs16,AX 1 


2 


3 


10 


Move AX to (seg:offset) 


A3 


MOV moffs32,EAX 1 


2 






Move EAX to (seg:offset) 


BO+rb 


MOV reg8,imm8 1 


2 


2 


4 


Move immediate byte to register 


B8+rw 


MOVreg16,imm16 1 


2 


2 


4 


Move immediate word to register 


B8+rd 


MOV reg32,imm32 1 


2 






Move immediate dword to register 
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Opcode 


Instruction 


Clocks 






Description 




486 


386 


286 


86 




C6 


MOV i7m8,imm8 1 


2/2 


2/3 


4/10+EA 


Move immediate byte to r/m byte 


C7 


MOVr/m16,imm16 1 


2/2 


2/3 


4/10+EA 


Move immediate word to r/m word 


C7 


MOV r/m32,imm32 1 


2/2 






Move immediate dword to r/m dword 



MOV copies the second operand to the first operand. 

If the destination operand is a segment register (DS, ES, SS, etc.), then 
data from a descriptor is also loaded into the register. The data for the 
register is obtained from the descriptor table entry for the selector given. 
A null selector (values 0000-0003) can be loaded into DS and ES registers 
without causing an exception; however, use of DS or ES causes a #GP(0), 
and no memory reference occurs. 

A MOV into SS inhibits all interrupts until after the execution of the next 
instruction (which is presumably a MOV into eSP). 



MOV Move to/from special registers 

386 processors and greater 



Opcode Instruction . Clocks Description 

Move (register) to (control register) 
Move (control register) to (register) 

Move (debug register) to (register) 
Move (debug register) to (register) 
Move (register) to (debug register) 
Move (register) to (debug register) 
Move (test register) to (register) 
Move (register) to (test register) 
Move (registers) to (test register3) 

These forms of MOV store or load the following special registers in or 
from a general-purpose register: 

■ Control Registers CRO, CR2, CR3, and CR4 (CR4 only on Pentium) 

■ Debug Registers DRO, DR1, DR2, DR3, DR6, and DR7 

■ Test Registers TR3, TR4, TR5, TR6, and TR7 (not valid on Pentium) 

32-bit operands are always used with these instructions, regardless of the 
operand-size attribute. 







486 


386 


OF 22 /r 


MOV,CR0,r32 


16 




OF 20 /r 


MOV r32,CR0/CR2/CR3/CR4 


4 


6 


OF 22 /r 


MOV CR0/CR2/CR3/CR4,r32 


4 


10/4/5 


OF 21 /r 


MOV r32,DR0 - 3 


10 


22 


OF 21 /r 


MOV r32,DR6/DR7 


10 


14 


OF 23 /r 


MOV DRO -3,r32 


11 


22 


OF 23 /r 


MOV DR6/DR7,r32 


11 


16 


OF 24 /r 


MOV r32,TR6/TR7 


4 


12 


OF 26 /r 


MOV TR6/TR7,r32 


4 


12 


OF 24 It 


MOV r32,TR3 




3 
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MOVS 
MOVSB 
MOVSW 
MOVSD 

Opcode Instruction 



Move data from string to string 
MOVSD 386 processors and greater 



Clocks 



Description 



A4 
A5 
A5 
A4 
A5 
A5 



MOVS m8,m8 

MOVS m16,m16 

MOVm32,m32 

MOVSB 

MOVSW 

MOVSD 



486 386 

7 7 



286 
5 



86 
18 
18 

18 
18 



Move byte [(E)SI] to ES:[(E)DI] 
Move word [(E)SI] to ES:[(E)DI] 
Move dword [(E)SI] to ES:[(E)DI] 
Move byte DS:[(E)SI] to ES:[(E)DI] 
Move word DS:[(E)SI] to ES:[(E)DI] 
Move dword DS:[(E)SI] to ES:[(E)DI] 



MOVS copies the byte or word at [(E)SIJ to the byte or word at ES: 
[(E)DI]. The destination operand must be addressable from the ES regis- 
ter; no segment override is possible for the destination. A segment over- 
ride can be used for the source operand; the default is DS. 

The addresses of the source and destination are determined solely by the 
contents of (E)SI and (E)DI. Load the correct index values into (E)SI and 
(E)DI before executing the MOVS instruction. MOVSB, MOVSW, and 
MOVSD are synonyms for the byte, word, and doubleword MOVS 
instructions. 

After the data is moved, both (E)SI and (E)DI are advanced automat- 
ically. If the direction flag is (CLD was executed), the registers are incre- 
mented; if the direction flag is 1 (STD was executed), the registers are de- 
cremented. The registers are incremented or decremented by 1 if a byte 
was moved, 2 if a word was moved, or 4 if a doubleword was moved. 

MOVS can be preceded by the REP prefix for block movement of CX 
bytes or words. Refer to the REP instruction for details of this operation. 



MOVSX 



Move with sign-extend 
386 processors and greater 



Opcode 


Instruction 


Clocks 


Description 






486 386 




0FBE7r 


MOVSX r16,r/m8 


3/3 3/6 


Move byte to word with sign extend 


OF BE /r 


MOVSX r32,r/m8 


3/3 3/6 


Move byte to dword 


OF BE /r 


MOVSXr32,r/m16 


3/3 3/6 


Move word to dword 



MOVSX reads the contents of the effective address or register as a byte or 
a word, sign-extends the value to the operand-size attribute of the instruc- 
tion (16 or 32 bits), and stores the result in the destination register. 



102 



Turbo Assembler Quick Reference Guide 



MOVZX 



Move with zero-extend 
386 processors and greater 



Opcode 


Instruction 


Clocks 


Description 


OF B6 /r 
OF B6 /r 
OF B7 It 


MOVZX r16,r/m8 
MOVZX r32,r/m8 
MOVZX r32,r/m16 


486 386 
3/3 3/6 
3/3 3/6 
3/3 3/6 


Move byte to word with zero extend 
Move byte to dword 
Move word to dword 



MOVZX reads the contents of the effective address or register as a byte 
or a word, zero extends the value to the operand-size attribute of the in- 
struction (16 or 32 bits), and stores the result in the destination register. 



MUL 



Unsigned multiplication of AL or AX 



Opcode Instruction 



Clocks 



Description 



486 386 286 86 

F6/4 MULr/m8 13/18,13/18 9-14/12-17 13/16 70-77/76-83+EA Unsigned multiply (AX 

[(AL 8 r/m byte) 
F7/4 MULr/m16 13/26,13/26 9-22/12-25 21/24 11 8-1 13/1 24-1 39+EA (DX:AX[AX * r/m word) 
F7/4 MULr/m32 13/42,13/42 9-38/12-41 Unsigned multiply 

(EDX: EAX[EAX * r/m 
dword) 

MUL performs unsigned multiplication. Its actions depend on the size of 
its operand, as follows: 

■ A byte operand is multiplied by AL; the result is left in AX. The carry 
and overflow flags are set to if AH is 0; otherwise, they are set to 1. 

■ A word operand is multiplied by AX; the result is left in DX: AX. DX 
contains the high-order 16 bits of the product. The carry and overflow 
flags are set to if DX is 0; otherwise, they are set to 1. 

■ A doubleword operand is multiplied by EAX and the result is left in 
EDX:EAX. EDX contains the high-order 32 bits of the product. The 
carry and overflow flags are set to if EDX is 0; otherwise, they are set 
to 1 (386 only). 
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NEG Two's complement negation 



T s 



Opcode 


Instruction 




Clocks 




Description 


F6 /3 
F7/3 
F7/3 


NEG r/m8 ' 
NEG r/m16 
NEG r/m32 


486 
1/3 
1/3 
1/3 


386 286 
2/6 2/7 
2/6 2/7 
2/6 


86 

3/16+EA 

3/16+EA 


Two's complement negate r/m byte 
Two's complement negate r/m word 
Two's complement negate r/m dword 



NEG replaces the value of a register or memory operand with its two's 
complement. The operand is subtracted from zero, and the result is 
placed in the operand. 

The carry flag is set to 1, unless the operand is zero, in which case the 
carry flag is cleared to 0. 



NOP No operation 



ODITSZAPC 



Opcode 


Instruction 




Clocks 






Description 


90 


NOP 


486 
1 


386 
3 


286 
3 


86 
3 


No operation 



NOP performs no operation. NOP is a one-byte instruction that takes up 
space but affects none of the machine context except (E)IP. 

NOP is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. 

NOT One's complement negation 



Opcode 


Instruction 




Clocks 






Description 


F6/2 
F7/2 
F7/2 


NOT r/m8 
NOTr/m16 
NOT r/m32 


486 

1/3 
1/3 
1/3 


386 
2/6 
2/6 
2/6 


286 

2/7 
2/7 
2/7 


86 

3/16+EA 

3/16+EA 


Reverse each bit of r/m byte 
Reverse each bit of r/m word 
Reverse each bit of r/m dword 



NOT inverts the operand; every 1 becomes a 0, and vice versa. 
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OR 



Logical inclusive OR 








D 


I T 


S 


Z A 


P C 











* 


* ? 


* 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




OCib 


OR AL,imm8 


1 


2 


3 


4 


OR immediate byte to AL 


OD iw 


ORAX,imm16 


1 


2 


3 


4 


OR immediate word to AX 


OD id 


OR EAX,imm32 


1 


2 






OR immediate dword to EAX 


80/1 ib 


OR r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


OR immediate byte to r/m byte 


81 /1 iw 


ORr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


OR immediate word to r/m word 


81 /1 id 


OR r/m32,imm32 


1/3 


2/7 






OR immediate dword to r/m dword 


83 /1 ib 


OR r/m16,imm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m word 


83 /1 ib 


OR r/m32,imm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m dword 


08 /r 


OR r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


OR byte register to r/m byte 


09 /r 


OR r/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


OR word register to r/m word 


09 /r 


OR r/m32,r32 


1/3 


2/6 






OR dword register to r/m dword 


OA/r 


ORr8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


OR byte register to r/m byte 


OB/r 


ORr16,r/m16 


1/2 


2/7 


2/7 


3/9+EA 


OR word register to r/m word 


OB/r 


OR r32,r/m32 


1/2 


2/7 






OR dword register to r/m word 



OR computes the inclusive OR of its two operands and places the result 
in the first operand. Each bit of the result is if both corresponding bits 
of the operands are 0; otherwise, each bit is 1. 

The optimized form of OR is SETFLAG (see Part 3). 



OUT 



Opcode Instruction 



Output to port- 



Clocks 



Description 





486 




386 


286 


86 




E6 ib OUT imm8,AL 


16,pm=1173r 


*,vm=29 


10,pm=4724** 


3 


10 


Output byte AL to 
immediate port number 


E7 ib OUT imm8,AX 


16,pm=11*/31* 


*,vm=29 


10,pm=4724** 


3 


10 


Output word AX to 
immediate port number 


E7 ib OUT 


16,pm=11*/3r 


*,vm=29 


10,pm=4725" 






Output dword EAX to 


imm8,EAX 












immediate port number 


EE OUT DX.AL 


16,pm=11731* 


*,vm=29 


11,pm=5725" 


3 


8 


Output byte AL to port 
number in DX 


EF OUT DX,AX 


16,pm=11731* 


*,vm=29 


11,pm=5725** 


3 


8 


Output word AX to 
port number in DX 


EF OUT DX,EAX 


16,pm=11731* 


*,vm=29 


11,pm=5725" 






Output dword EAX to 
port number in DX 


* If CPL < IOPL 














** If CPL > IOPL or if in virtual 8086 mode 
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OUT transfers a data byte or data word from the register (AL, AX, or 
EAX) given as the second operand to the output port numbered by the 
first operand. Output to any port from to 65535 is performed by placing 
the port number in the DX register and then using an OUT instruction 
with DX as the first operand. If the instruction contains an eight-bit port 
ID, that value is zero-extended to 16 bits. 



OUTS 
OUTSB 
OUTSW 
OUTSD 



Output string to port 
OUTS/OUTSB/OUTSW 80186 and greater 
OUTSD 386 processors and greater 



Opcode Instruction 



Clocks 



Description 



486 386 286 

6E 0UTSDX,r/m8 17,pm=10732**,vm=30 14,pm=8728" 5 

6F 0UTSDX,r/m16 17,pm=10732**,vm=30 14,pm=8728** 5 

6F OUTSDX,r/m32 17,pm=10732**,vm=30 14,pm=8728** 

6E OUTSB 17,pm=10732**,vm=30 14,pm=8728" 5 

6F OUTSW 17,pm=10732**,vm=30 14,pm=8728** 5 

6F OUTSD 17,pm=10732**,vm=30 14,pm=8728" 



Output byte [(E)SI] to port 

inDX 

Output word [(E)SI] to port 

inDX 

Output dword [(E)SI] to 

port in DX 

Output byte DS:[(E)SI] to 

port in DX 

Output word DS:[(E)SI] to 

port number in DX 

Output dword DS:[(E)SI] to 

port in DX 



OUTS transfers data from the memory byte, word, or doubleword at the 
source-index register to the output port addressed by the DX register. If 
the address-size attribute for this instruction is 16 bits, SI is used for the 
source-index register; otherwise, the address-size attribute is 32 bits, and 
ESI is used for the source-index register. 

OUTS does not allow specification of the port number as an immediate 
value. The port must be addressed through the DX register value. Load 
the correct value into DX before executing the OUTS instruction. 

The address of the source data is determined by the contents of source-in- 
dex register. Load the correct index value into SI or ESI before executing 
the OUTS instruction. v 

After the transfer, source-index register is advanced automatically. If the 
direction flag is (CLD was executed), the source-index register is incre- 
mented; if the direction flag is 1 (STD was executed), it is decremented. 
The amount of the increment or decrement is 1 if a byte is output, 2 if a 
word is output, or 4 if a doubleword is output. 

OUTSB, OUTSW, and OUTSD are synonyms for the byte, word, and dou- 
bleword OUTS instructions. OUTS can be preceded by the REP prefix for 
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block output of CX bytes or words. Refer to the REP instruction for de- 
tails on this operation. 



POP Pop a word from the stack 



Opcode Instruction Clocks Description 







486 


386 




286 




86 




8F/0 


POPm16 


6 


5 




5 




17+EA 


Pop top of stack into memory word 


8F/0 


POP m32 


6 


5 










Pop top ot stack into memory dword 


58+rw 


POP r16 


4, 


4 




5 




8 


Pop top of stack into word register 


58+rd 


POP r32 


4 


4 










Pop top of stack into dword register 


1F 


POPDS 


'3 


7,pm= 


=21 


5,pm= 


=20 


8 


Pop top of stack into DS 


07 


POPES 


3 


7,pm= 


=21 


5,pm= 


=20 


8 


Pop top of stack into ES 


17 


POPSS 


3 


7,pm= 


=21 


5,pm= 


=20 


8 


Pop top of stack into SS 


0FA1 


POPFS 


3 


7,pm= 


=21 








Pop top of stack into FS 


0FA9 


POPGS 


3, 


7,pm= 


=21 








Pop top of stack into GS 



POP replaces the previous contents of the memory, the register, or the 
segment register operand with the word on the top of the stack, ad- 
dressed by SS:SP (address-size attribute of 16 bits) or SS:ESP (address- 
size attribute of 32 bits). The stack pointer SP is incremented by 2 for an 
operand-size of 16 bits or by 4 for an operand-size of 32 bits. It then 
points to the new top of stack. 

POP CS is not an instruction. Popping from the stack into the CS register 
is accomplished with a RET instruction. 

If the destination operand is a segment register (DS, ES, FS, GS, or SS), 
the value popped must be a selector. In protected mode, loading the selec- 
tor initiates automatic loading of the descriptor information associated 
with that selector into the hidden part of the segment register; loading 
also initiates validation of both the selector and the descriptor informa- 
tion. 

A null value (0000-0003) may be popped into the DS, ES, FS, or GS regis- 
ter without causing a protection exception. An attempt to reference a seg- 
ment whose corresponding segment register is loaded with a null value 
causes a general protection fault. No memory reference occurs. The saved 
value of the segment register is null. 

A POP SS instruction inhibits all interrupts, including NMI, until after 
execution of the next instruction. This allows sequential execution of POP 
SS and POP ESP instructions without danger of having an invalid stack 
during an interrupt. However, use of the LSS instruction is the preferred 
method of loading the SS and ESP registers. 

Note: Turbo Assembler extends the syntax of the POP instruction to facili- 
tate popping multiple items in sequence. The items popped can include 
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any legal POP value, including registers, immediate values, and memory 
locations. This feature does not actually affect the code generated. 



POPA 

POPAD 

POPAW 



Pop all general registers 

POPA 80186 processors and greater 

POPAD 386 processors and greater 



Opcode 


Instruction 




Clocks 


Description 


61 
61 
61 


POPA 

POPAD 

POPAW 


486 
9 
9 
9 


386 286 

24 19 

24 

24 19 


Pop Dl, SI, BP, BX, DX, CX, AX 

Pop EDI, ESI, EBP, EBX, EDX, ECX, EAX 

Pop Dl, SI, BP, BX, DX, CX, AX 



POPA pops the eight 16- or 32-bit general registers depending on the seg- 
ment size. However, the SP value is discarded instead of loaded into SP. 
POPA reverses a previous PUSHA, restoring the general registers to their 
values before PUSHA was executed. The first register popped is DL 

POPAD pops the eight 32-bit general registers. The ESP value is dis- 
carded instead of loaded into ESP. POPAD reverses the previous 
PUSH AD, restoring the general registers to their values before PUSHAD 
was executed. The first register popped is EDI. 

POPAW pops WORD-sized registers. (Can only be used for VERSION 
T320 or higher.) 



POPF 

POPFD 

POPFW 



Pop from stack into FLAGS or EFLAGS register 
POPFD 386 processors and greater 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


9D 


POPF 


9,pm=6 


5 


5 


9D 


POPFD 


9,pm=6 


5 




9D 


POPFW 


9,pm=6 


5 


5 



86 



Pop top of stack into FLAGS 
Pop top of stack into EFLAGS 
Pop top of stack into FLAGS. 



POPF/POPFD pops the word or doubleword on the top of the stack and 
stores the value in the flags register. If the operand-size attribute of the in- 
struction is 16 bits, then a word is popped and the value is stored in 
FLAGS. If the operand-size attribute is 32 bits, then a doubleword is 
popped and the value is stored in EFLAGS. 

Note that bits 16 and 17 of EFLAGS, called VM and RF, respectively, are 
not affected by POPF or POPFD. 
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The I/O privilege level is altered only when executing at privilege level 
0. The interrupt flag is altered only when executing at a level at least as 
privileged as the I/O privilege level. (Real-address mode is equivalent to 
privilege level 0.) If a POPF instruction is executed with insufficient 
privilege, an exception does not occur, but the privileged bits do not 
change. 

POPFW always pops into FLAGS WORD-style. (Can only be used for 
VERSION T320 or higher.) 



PUSH 



Push operand onto the stack 







D 


I 


T 


S 


Z A P C 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




FF/6 


PUSH m16 


4 


5 


5 


16+EA 


Push memory word 


FF/6 


PUSH m32 


4 


5 






Push memory dword 


50+ /r 


PUSH r16 


1 


2 


3 


11 


Push register word 


50+ /r 


PUS.Hr32 


1 


2 






Push register dword 


6A 


PUSH imm8 


1 


2 3 






Push immediate byte 


68 


PUSHimm16 


1 


2 


3 




Push immediate word 


68 


PUSH imm32 


1 


2 






Push immediate dword 


OE 


PUSH CS 


3 


2 


3 


10 


Push CS 


16 


PUSH SS 


3 


2 


3 


10 


Push SS 


1E 


PUSH DS 


3 


2 


3 


10 


Push DS 


06 


PUSH ES 


3 


2 




10 


Push ES 


0FA0 


PUSH FS 


3 


2 






Push FS 


0FA8 


PUSH GS 


3 


2 






Push GS 



PUSH decrements the stack pointer by 2 if the operand-size attribute of 
the instruction is 16 bits; otherwise, it decrements the stack pointer by 4. 
PUSH then places the operand on the new top of stack, which is pointed 
to by the stack pointer. 

The 386 PUSH ESP instruction pushes the value of the ESP as it existed 
before the instruction. The 80286 PUSH SP instruction also pushes the 
value of SP as it existed before the instruction. This differs from the 8086, 
where PUSH SP pushes the new value (decremented by 2). 

Note: Turbo Assembler extends the syntax of the PUSH instruction to fa- 
cilitate pushing multiple items in sequence. The items pushed can in- 
clude any legal PUSH value, including registers, immediate values, and 
memory locations. This feature does not actually affect the code gener- 
ated. In addition, the PUSH instruction allows constant arguments even 
when generating code for the 8086 processor. Such instructions are re- 
placed in the object code by a 10-byte sequence that simulates the 
80186/286/386 PUSH immediate value instruction. 
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PUSHA 

PUSHAD 

PUSHAW 



Push all general registers 

PUSHA 80186 processors and greater 

PUSHAD 386 processors and greater 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 




60 


PUSHA 


11 


18 


17 


Push AX,CX,DX,BX,original SP,BP,SI 


60 


PUSHAD 


11 


18 




Push EAX,ECX,EDX,EBX 


60 


PUSHAW 


11 


18 


17 


Push AX,CX,DX,BX,original SP,BP,SI 



PUSHA and PUSHAD save the 16-bit or 32-bit general registers, respec- 
tively, on the stack depending on the segment size. PUSHA decrements 
the stack pointer (SP) by 16 to hold the eight word values. PUSHAD dec- 
rements the stack pointer (ESP) by 32 to hold the eight doubleword val- 
ues. Because the registers are pushed onto the stack in the order in which 
they were given, they appear in the 16 or 32 new stack bytes in reverse or- 
der. The last register pushed is DI or EDI. 

PUSHAW always pushes WORD-style. (Can only be used for VERSION 
T320 or higher.) 



PUSHF 

PUSHFD 

PUSHFW 



Push flags register onto the stack 
PUSHFD 386 processors and greater 



Opcode 


Instruction 




Clocks 




Description 






486 


386 286 


86 




9C 


PUSHF 


4,pm=3 


4 3 


10 


Push FLAGS 


9C 


PUSHFD 


4,pm=3 


4 




Push EFLAGS 


9C 


PUSHFW 


4,pm=3 


4 3 


10 


Push FLAGS 



PUSHF decrements the stack pointer by 2 and copies the FLAGS register 
to the new top of stack; PUSHFD decrements the stack pointer by 4, and 
the 386 EFLAGS register is copied to the new top of stack which is 
pointed to by SS:ESP. 

PUSHFW always pops WORD-sized registers. (Can only be used for 
VERSION T320 or higher.) 
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RCL 
RCR 


Rotate 






















ROL 


D 

* 


I T 


S 


ZAP 


c 

* 


ROR 














Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




DO/2 


RCL r/m8,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 9 bits (CF,r/m byte) 
left once 


D2/2 


RCL r/m8,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 9 bits (CF,r/m byte) 
left CL times 


CO 11 ib 


RCL r/m8,imm8 


8-30/9-31 


9/10 


5/8 




Rotate 9 bits (CF,r/m byte) 
left imm8 times 


D1/2 


RCLr/m16,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 17 bits (CF,r/m 
word) left once 


D3/2 


RCLr/m16,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 17 bits {CF, r/m 
word) left CL times 


C1 /2 ib 


RCLr/m16, 
imm8 


8-30/9-31 


9/10 


5/8 




Rotate 17 bits (CF,r/m 
word)) left imm8 times 


D1/2 


RCL r/m32,1 


3/4 


9/10 






Rotate 33 bits (CF,r/m 
dword) left once 


D3/2 


RCL r/m32,CL 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) left CL times 


C1 /2 ib 


RCLr/m32, 
imm8 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) left, imm8 times 


DO/3 


RCR r/m8,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 9 bits (CF,r/m byte) 
right once 


D2/3 


RCR r/m8,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 9 bits (CF,r/m byte) 
right CL times 


CO /3 ib 


RCR r/m8,imm8 


8-30/9-31 


9/10 


5/8 




Rotate 9 bits (CF,r/m byte) 
right imm8 times 


D1/3 


RCR r/m16,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 17 bits (CF,r/m 
word) right once 


D3/3 


RCR r/m16,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 17 bits (CF,r/m 
word) right CL times 


C1 /3 ib 


RCRr/m16, 
imm8 


8-30/9-31 


9/10 


5/8 




Rotate 17 bits (CF,r/m 
word) right imm8 times 


D1/3 


RCR r/m32,1 


3/4 


9/10 






Rotate 33 bits (CF,r/m 
dword) right once 


D3/3 


RCR r/m32,CL 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) right CL times 


C1 /3 ib 


RCR r/m32, 
imm8 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) right imm8 times 


DO/0 


ROL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 8 bits r/m byte left 
once 


D2/0 


ROL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 8 bits r/m byte left 
CL times 


CO /0 ib 


ROL r/m8, imm8 2/4 


3/7 


5/8 




Rotate 8 bits r/m byte left 














imm8 times 


D1/0 


ROLr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 16 bits r/m word left 


D3/0 


ROLr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


once 

Rotate 16 bits r/m word left 

CL times 


C1 /0 ib 


ROLr/m16, 
imm8 


2/4 


3/7 


5/8 




Rotate 16 bit r/m word left 
imm8 times 


D1/0 


ROLr/m32,1 


3/4 


3/7 






Rotate 32 bits r/m dword left 
once 
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Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




D3/0 


ROL r/m32,CL 


3/4 


3/7 






Rotate 32 bits r/m dword left 
CL times 


C1 /0 ib 


ROL r/m32, 
imm8 


2/4 


3/7 






Rotate 32 bits r/m dword left 
imm8 times 


DO/1 


ROR r/m8,1 


3/4 


,3/7 . 


2/7 


2/15+EA 


Rotate 8 bits r/m byte right 
once , 


D2/1 


ROR r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 8 bits r/m byte right 
CL times 


CO /1 ib 


ROR r/m8, 
imm8 


2/4 


3/7 


5/8 




Rotate 8 bits r/m word right 
imm8 times 


D1/1 


ROR r/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 16 bits r/m word 
right once 


D3/1 


ROR r/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 16 bits r/m word 
right CL times 


C1 /1 ib 


ROR r/m16, 
imm8 


2/4 


3/7 • 


5/8 




Rotate 16 bit r/m word right 
imm8 times 


D1/1 


ROR r/m32,1 


3/4 


3/7 






Rotate 32 bits r/m dword 
right once 


D3/1 


ROR r/m32,CL 


3/4 


3/7 






Rotate 32 bits r/m dword 
right CL times 


C1 /1 ib 


ROR r/m32, 
imm8 


2/4 


3/7 






Rotate 32 bits r/m dword 
right imm8 times 


Add 1 clock to the times shown for each rotate made (80286 only). 





Each rotate instruction shifts the bits of the register or memory operand 
given. The left rotate instructions shift all the bits upward, except for the 
top bit, which is returned to the bottom. The right rotate instructions do 
the reverse: The bits shift downward until the bottom bit arrives at the 
top. 

For the RCL and RCR instructions, the carry flag is part of the rotated 
quantity. RCL shifts the carry flag into the bottom bit and shifts the top 
bit into the carry flag; RCR shifts the carry flag into the top bit and shifts 
the bottom bit into the carry flag. For the ROL and ROR instructions, the 
original value of the carry flag is not a part of the result, but the carry 
flag receives a copy of the bit that was shifted from one end to the other. 

The rotate is repeated the number of times indicated by the second oper- 
and, which is either an immediate number or the contents of the CL regis- 
ter. To reduce the maximum instruction execution time, the 80286/386 
does not allow rotation counts greater than 31. If a rotation count greater 
than 31 is attempted, only the bottom five bits of the rotation are used. 
The 8086 does not mask rotation counts. The 386 in virtual 8086 mode 
does mask rotation counts. 

The overflow flag is defined only for the single-rotate forms of the in- 
structions (second operand = 1). It is undefined in all other cases. For left 
shifts /rotates, the CF bit after the shift is XORed with the high order re- 
sult bit. For right shifts /rotates, the high-order two bits of the result are 
XORed to get OF. 
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RDMSR Read from Model Specific Register 

Pentium processors and greater 



Opcode 


Instruction 


Clocks 


Description 


OF 32 


RDMSR 


Pentium 
20-24 


Read Model Specific Register indicated by 
ECX into EDX:EAX 



The value in ECX specifies one of the 64-bit Model Specific Registers of 
the Pentium processor. The content of that Model Specific Register is cop- 
ied into EDX:EAX. EDX is loaded with the high-order 32 bits, and EAX 
is loaded with the low-order 32 bits. 

The following values are used to select model specific registers on the 
Pentium processor: 

Value (in Hex) Register Name Description 

OOh Machine Check Address Stores address of cycle causing 

the exception. 

01 h Machine Check Type Stores cycle type of cycle causing 
the exception. 

Other values used to preform cache, TLB and BTB testing and perform- 
ance monitoring, are availible under a non-disclosure agreement from In- 
tel. 

Protected mode exceptions: #GP(0) if either the current privilege level is 
not or the value in ECX does not specify a Model-Specific Register that 
is implemented in the Pentium processor. 

Real mode exceptions: #GP if the value in ECX does not specify a Model- 
Specific Register that is implemented in the Pentium processor. 

Virtual 8086 mode exceptions: #GP(0) if instruction execution is at- 
tempted. 

Notes: This instruction must be executed at privilege level or in real-ad- 
dress mode; otherwise a protection exception will be generated. 

If less than 64 bits are implemented in a model specific register, the value 
returned to EDX:EAX, in the locations corrisponding to the unimple- 
mented bits, is unpredictable. 

RDMSR is used to read the content of Model-Specific Registers that con- 
trol functions for testability, execution tracing, performance monitoring 
and machine check errors. Refer to the Pentium Processor Data Book for 
more information or contact Intel. 
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The values 3h, OFh, and values above 13h are reserved. Do not execute 
RDMSR with reserved values in ECX. 



RDTSC 



(Propriatary instruction. Contact Intel for more 

information.) 

Pentium processors and greater 



REP 
REPE 




Repeat following string operation 














REPZ 




O D I 


T S Z 
* 


A 


P C 




REPNE 












REPNZ 












Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




F3 6C 


REP INS 


16+8(E)CX, 


13+6*(E)CX, 


5+4*CX 




Input (E)CX bytes from 




r/m8,DX 


pm=10+8(E)CX*V 
30+8(E)CX*2,VM= 
29+8(E)CX 


pm=7+6*(E)CX/ 
27+6*i*(E)CX*2 






port DX into ES:[(E)DI] 


F3 6D 


REP INS 


16+8(E)CX, ■ 


13+6*(E)CX, 


5+4*CX 




Input (E)CX words from 




r/m16,DX 


pm=10+8(E)CX*V 
30+8(E)CX*2,VM= 
29+8(E)CX 


pm=7+6*(E)CX/ 
27+6*i*(E)CX*2 






port DX into ES:[(E)DI] 


F3 6D 


REP INS 


16+8(E)CX, 


13+6*(E)CX, 






Input (E)CX dwords 




r/m32,DX 


pm=10+8(E)CX*V 
30+8(E)CX*2,VM= 
29+8(E)CX 


pm=7+6*(E)CX/ 
27+6*i*(E)CX* 2 






from port DX into 
ES:[(E)DI] 


F3A4 


REP MOVS 
m8,m8 


5*3,13*4,12+3(E) 
CX*5 


5+4*(E)CX 


5+4*CX 


9+17*CX 


Move (E)CX bytes from 
[(E)SI]toES:[(E)DI] 


F3A5 


REP MOVS 
m16,m16 


5*3,13*4,12+3(E) 
CX*5 


5+4*(E)CX 


5+4*CX 


9+17*CX 


Move (E)CX words from 
[(E)SI]toES:[(E)DI] 


F3A5 


REP MOVS 
m32,m32 


5*3,13* 4 ,12+3(E) 

CX*5 


5+4*(E)CX 






Move (E)CX dwords 
from [(E)SI] to ES:[(E)DI] 


F3 6E 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 


5+4*CX 




Output (E)CX bytes 




DX,r/m8 


pm=11+5(E)CX*V 
31+5(E)CX*2 


pm=6+5*(E) 

CX/26+5*i*(E) 

CX*2 






from [(E)SI] to port DX 


F3 6F 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 


5+4*CX 




Output (E)CX words 




DX,r/m16 


pm=11+5(E)CX*V 
31+5(E)CX*2 


pm=6+5*(E) 
CX/26+5* 1 *(E) 

CX*2 






from [(E)SI] to port DX 


F3 6F 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 






Output(E)CX dwords 




DX,r/m32 


pm=11+5(E)CX*V 
31+5(E)CX*2 


pm=6+5*(E) 
CX/26+5* 1 *(E) 

CX*2 






from [(E)SI] to port DX 


F2AC 


REP LODS 
m8 


5*3,7+4(E)CX*6 








Load (E)CX bytes from 
[(E)SI] to AL 


F2AD 


REP LODS 
m16 


5*3,7+4(E)CX*6 








Load (E)CX words from 
[(E)SI] to AX 


F2AD 


REP LODS 
m32 


5*3,7+4(E)CX*6 


*> 






Load (E)CX dwords 
from [(E)SI] to EAX 


F3AA 


REP STOS 
m8 


5*3,7+4(E)CX*6 


5+5*(E)CX 


4+3*CX 


9+10*CX 


Fill (E)CX bytes at 

ES:[(E)DI]withAL 
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Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




F3AB 


REP STOS 
m16 


5*3,7+4(E)CX*6 


5+5*(E)CX 


4+3*CX 


9+10*CX 


Fill (E)CX words at 
ES:[(E)DI] with AX 


F3AB 


REP STOS 
m32 


5*3,7+4(E)CX*6 


5+5*(E)CX 






Fill (E)CX dwords at 
ES:[(E)DI] with EAX 


F3A6 


REPE 
CM PS 
m8,m8 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find nonmatching bytes 
in ES:[(E)DI] and [(E)SI] 


F3A7 


REPE 
CM PS 
m16,m16 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find nonmatching 
words in ES:[(E)DI] and 
[(E)SI] 


F3A7 


REPE 
CM PS 
m32,m32 


5*3,7+7(E)CX*6 


5+9*N 






Find nonmatching 
dwords in ES:[(E)DI] 
and [(E)SI] 


F3AE 


REPE 
SCAS m8 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find non-AL byte 
starting at ES:[(E)DI] 


F3AF 


EPE SCAS 
m16 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find non-AX word 
starting at ES:[(E)DI] 


F3AF 


REPE 
SCAS m32 


5*3,7+5(E)CX*6 


5+8*N 






Find non-EAX dword 
starting at ES:[(E)DI] 


F2A6 


REPNE 
CM PS 
m8,m8 


5*3,7+7(E)CX*e 


5+9*N 


5+9*N 


9+22*N 


Find matching bytes in 
ES:[(E)DI] and [(E)SI] 


F2A7 


REPNE 
CM PS 
m16,m16 


5 4 3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find matching words in 
ES:[(E)DI] and [(E)SI] 


F2A7 


REPNE 
CM PS 
m32,m32 


5*3,7+7(E)CX*6 


5+9*N 






Find matching dwords 
in ES:[(E)DI] and [(E)SI] 


F2AE 


REPNE 
SCAS m8 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find AL 


F2AF 


REPNE 
SCAS m16 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find AX 


F2AF 


REPNE 
SCAS m32 


5*3,7+5(E)CX*6 


5+8*N 






Find EAX 


*1 IfCPL 


< IOPL 












*2 If CPL 


>IOPL 












*3 If (E) CX = 












% If (E) CX = 1 












*5 If (E) CX 1 












*6 If (E) CX 













REP 7 REPE (repeat while equal), and REPNE (repeat while not equal) are 
prefixes that are applied to string operations. Each prefix causes the 
string instruction that follows to be repeated the number of times indi- 
cated in the count register or (for REPE and REPNE) until the indicated 
condition in the zero flag is no longer met. 

Synonymous forms of REPE and REPNE are REPZ and REPNZ, respec- 
tively. 

The REP prefixes apply only to one string instruction at a time. To repeat 
a block of instructions, use the LOOP instruction or another looping con- 
struct. 

The precise action for each iteration is as follows: 
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1. If the address-size attribute is 16 bits, use CX for the count register; if 
the address-size attribute is 32 bits, use ECX for the count register. 

2. Check CX. If it is zero, exit the iteration, and move to the next instruc- 
tion. 

3. Acknowledge any pending interrupts. 

4. Perform the string operation once. 

5. Decrement CX or ECX by one; no flags are modified. 

6. Check the zero flag if the string operation is SCAS or CMPS. If the re- 
peat condition does not hold, exit the iteration and move to the next in- 
struction. Exit the iteration if the prefix is REPE and ZF is (the last com- 
parison was not equal), or if the prefix is REPNE and ZF is one (the last 
comparison was equal). 

7. Return to step 1 for the next iteration. 

Repeated CMPS and SCAS instructions can be exited if the count is ex- 
hausted or if the zero flag fails the repeat condition. These two cases can 
be distinguished by using either the JCXZ instruction, or by using the 
conditional jumps that test the zero flag (JZ, JNZ, and JNE). 

RET Return from procedure 



Opcode Instruction Clocks Description 







486 


386 


286 


86 




C3 


RET 


5. 


10+m 


11 


16 


Return (near) to caller 


CB 


RET 


13,pm=18 


18+m,pm= 
32+m 


15,pm=25 


26 


Return (far) to caller, same 
privilege 


CB 


RET 


13,pm=33 


pm=68 


55 




Return (far) 


C2iw 


RETimm16 


5 


10+m 


11 


20 


Return (near) 


CAiw 


RETimm16 


14,pm=17 


18+m,pm= 
32+m 


15,pm=25 


25 


Return (far) pop imm16 bytes 


CAiw 


RETimm16 


14,pm=33 


pm=68 


55 




Return (far) 



RET transfers control to a return address located on the stack. The ad- 
dress is usually placed on the stack by a CALL instruction, and the re- 
turn is made to the instruction that follows the CALL. 

The optional numeric parameter to RET gives the number of stack bytes 
(OperandMode = 16) or words (OperandMode = 32) to be released after 
the return address is popped. These items are typically used as input pa- 
rameters to the procedure called. 

For the intrasegment (near) return, the address on the stack is a segment 
offset, which is popped into the instruction pointer. The CS register is un- 
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changed. For the intersegment (far) return, the address on the stack is a 
long pointer. The offset is popped first, followed by the selector. 

In real mode, CS and IP are loaded directly. In protected mode, an inter- 
segment return causes the processor to check the descriptor addressed by 
the return selector. The AR byte of the descriptor must indicate a code 
segment of equal or lesser privilege (or greater or equal numeric value) 
than the current privilege level. Returns to a lesser privilege level cause 
the stack to be reloaded from the value saved beyond the parameter 
block. 

The DS, ES, FS, and GS segment registers can be set to by the RET in- 
struction during an interlevel transfer. If these registers refer to segments 
that cannot be used by the new privilege level, they are set to to pre- 
vent unauthorized access from the new privilege level. 



RSM Resume from System Management Mode 

Pentium processors and greater 



Opcode 


Instruction 


Clocks 


Description 


OFAA 


RSM 


Pentium 
83 


Resume operation of interrupted program. 



Resume operation of a program by a System Management Mode (SMM) 
interrupt. The processor state is restored from the dump created upon en- 
trance to SMM. Note, however, that the contents of the model-specific 
registers are not affected. The processor leaves SMM and returns control 
to the interrupted application or operating system. If the processor de- 
tects any invalid state information, it enters the shutdown state. This hap- 
pens in any of the following situations: 

■ The value stored in the State Dump Base field is not a 32 Kbyte aligned 
address. 

■ Any reserved bit in CR4 is set to 1. 

■ Any combination of bits in CRO is illegal; namely, (PG=1 and PE=0) or 
(NW=1 and CD=0). 

Protected mode, Real mode, and Virtual 8086 mode exception: #UD if an 
attempt is made to execute this instruction when the processor is not in 
SMM. 

Notes: for more information about SMM and the behavior of the RSM in- 
struction, see the Pentium Processor User's Manual (availible from Intel) 
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SAHF Store AH into Flags 



Opcode Instruction 




Clocks 




Description 


9E SAHF 


486 
2 


386 286 
3 2 


86 
4 


Store AH flags SF ZF xx AF xx PF xx CF 



SAHF loads the flags listed above with values from the AH register, from 
bits 7, 6, 4, 2 and 0, respectively. 



SAL 
SAR 


Shift instructions 


















SHL 




* 


D 


I 


T 


S Z A 
* * •> 


P c 

* * 


SHR 














Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




DOM 


SAL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m byte by 2 


D2/4 


SAL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Multiply r/m byte by 2, CL times 


CO /4 ib 


SAL r/m8,imm8 


2/4 


3/7 


5/8 




Multiply r/m byte by 2 


D1/4 


SALr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m word by 2 


D3/4 


SALr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Multiply r/m word by 2, CL times 


C1 /4 ib 


SALr/m16,imm8 


2/4 


3/7 


5/8 




Multiply r/m word by 2 


D1 /4 


SAL r/m32,1 


3/4 


3/7 






Multiply r/m dword by 2 


D3/4 


SAL r/m32,CL 


3/4 


3/7 






Multiply r/m dword by 2 


C1 14 ib 


SAL r/m32,imm8 


2/4 


3/7 






Multiply r/m dword by 2 


DO/7 


SAR r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Signed divide** r/m byte by 2 


D2/7 


SAR r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Signed divide** r/m byte by 2 


CO n ib 


SAR r/m8,imm8 


2/4 


3/7 


5/8 




Signed divide** r/m byte by 2 


D1 n 


SAR r/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Signed divide** r/m word by 2 


D3/7 


SAR r/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Signed divide** r/m word by 2 


C1/7ib 


SAR r/m16,imm8 


2/4 


3/7 


5/8 




Signed divide** r/m word by 2 


D1/7 


SAR r/m32,1 


3/4 


3/7 






Signed divide** r/m dword by 2 


D3/7 


SAR r/m32,CL 


3/4 


3/7 






Signed divide** r/m dword by 2, 
CL times 


C1/7 


SAR r/m32,imm8 


2/4 


3/7 






Signed divide** r/m dword by 2 


DO/4 


SHL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m byte by 2 


D2/4 


SHL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Multiply r/m byte by 2, CL times 


CO /4 ib 


SHL r/m8,imm8 


2/4 


3/7 


5/8 




Multiply r/m byte by 2 


D1 14 


SHL r/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m word by 2 


D3/4 


SHL r/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Multiply r/m word by 2, CL times 


C1 14 ib 


SHL r/m16,imm8 


2/4 


3/7 


5/8 




Multiply r/m word by 2 


D1/4 


SHL r/m32,1 


3/4 


3/7 






Multiply r/m dword by 2 


D3/4 


SHL r/m32,CL 


3/4 


3/7 






Multiply r/m dword by 2 


C1/4ib 


SHL r/m32,imm8 


2/4 


3/7 






Multiply r/m dword by 2 



118 Turbo Assembler Quick Reference Guide 



Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




DO/5 


SHR r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Unsigned divide r/m byte by 2 


D2/5 


SHR r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Unsigned divide r/m byte by 2 


CO /5 ib 


SHR r/m8,imm8 


2/4 


3/7 


5/8 




Unsigned divide r/m byte by 2 


D1/5 


SHR r/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Unsigned divide r/m word by 2 


D3/5 


SHRr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Unsigned divide r/m word by 2 


C1 /5 ib 


SHRr/m16,imm8 


2/4 


3/7 


5/8 




Unsigned divide r/m word by 2 


D1/5 


SHR r/m32,1 


3/4 


3/7 






Unsigned divide r/m dword by 2 


D3/5 


SHR r/m32,CL 


3/4 


3/7 






Unsigned divide r/m dword by 2 


C1 /5 ib 


SHR r/m32,imm8 


2/4 


3/7 






Unsigned divide r/m dword by 2 


"Not the 


same division as IDIV; rounding is toward negative infinity. 





SAL (or its synonym, SHL) shifts the bits of the operand upward. The 
high-order bit is shifted into the carry flag, and the low-order bit is set to 
0. 

SAR and SHR shift the bits of the operand downward. The low-order bit 
is shifted into the carry flag. The effect is to divide the operand by 2. SAR 
performs a signed divide with rounding toward negative infinity (not the 
same as IDIV); the high-order bit remains the same. SHR performs an un- 
signed divide; the high-order bit is set to 0. 

The shift is repeated the number of times indicated by the second oper- 
and, which is either an immediate number or the contents of the CL regis- 
ter. To reduce the maximum execution time, the 80286/386 does not al- 
low shift counts greater than 31. If a shift count greater than 31 is 
attempted, only the bottom five bits of the shift count are used. (The 8086 
uses all eight bits of the shift count.) 

The overflow flag is set only if the single-shift forms of the instructions 
are used. For left shifts, OF is set to if the high bit of the answer is the 
same as the result of the carry flag (that is, the top two bits of the original 
operand were the same); OF is set to 1 if they are different. For SAR, OF 
is set to for all single shifts. For SHR, OF is set to the high-order bit of 
the original operand. 



SBB 



Integer subtraction with borrow 



Opcode Instruction 



Clocks 



Description 



1Cib SBBAL,imm8 
1Diw SBBAX,imm16 



486 386 286 86 
12 3 4 



Subtract with borrow immediate byte 
from AL 

Subtract with borrow immediate word 
from AX 
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Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




1D id . 


SBB EAX,imm32 


1 


2 






Subtract with borrow immediate dword 
from EAX 


80 /3 ib 


SBB r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow immediate byte 
from r/m byte 


81 /3iw 


SBBr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow immediate word 
from r/m word 


81 /3 id 


SBB r/m32,imm32 


1/3 


2/7 






Subtract with borrow immediate dword 
from r/m dword 


83 /3 ib 


SBBr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow sign-extended 
immediate byte from r/m word 


83 /3 ib 


SBB r/m32,imm8 


1/3 


2/7 






Subtract with borrow sign-extended 
immediate byte from r/m dword 


18 /r 


SBB r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


Subtract with borrow byte register from 
r/m byte 


19 /r 


SBBr/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


Subtract with borrow word register 
from r/m word 


19 /r 


SBB r/m32,r32 


1/3 


2/6 






Subtract with borrow dword register 
from r/m dword 


1A/r 


SBBr8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Subtract with borrow byte register from 
r/m byte 


1B/r 


SBBr16,r/m16 


1/2 


2/7 


2/7 


3/9+EA 


Subtract with borrow word register 
from r/m word 


1B/r 


SBB r32,r/m32 


1/2 


2/7 




' 


Subtract with borrow dword register 
from r/m dword 



SBB adds the second operand (DEST) to the carry flag (CF) and subtracts 
the result from the first operand (SRC). The result of the subtraction is as- 
signed to the first operand (DEST), and the flags are set accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended. 



SCAS 
SCASB 
SCASW 
SCASD 



Compare string data 

SCASD 386 processors and greater 



Opcode Instruction 



Clocks 



Description 



AE 
AF 
AF 
AE 
AF 
AF 



SCAS m8 
SCAS m16 
SCAS m32 
SCASB 
SCASW 
SCASD 



486 

6 

6 

6 

6 

6 

6 



386 

7 

7 

7 

7 

7 

7 



286 
7 



86 
15 

15 

15 
15 



Compare bytes AL - ES:[DI] 
Compare words AX - ES: [Dl] 
Compare dwords EAX - ES: [C 
Compare bytes AL - ES:[DI] 
Compare words AX - ES: [Dl] 
Compare dwords EAX - ES: [C 



SCAS subtracts the memory byte or word at the destination register from 
the AL, AX or EAX register. The result is discarded; only the flags are set. 
The operand must be addressable from the ES segment; no segment over- 
ride is possible. 
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If the address-size attribute for this instruction is 16 bits, DI is used as the 
destination register; otherwise, the address-size attribute is 32 bits and 
EDI is used. 

The address of the memory data being compared is determined solely by 
the contents of the destination register, not by the operand to SCAS. The 
operand validates ES segment addressability and determines the data 
type. Load the correct index value into DI or EDI before executing SCAS. 

After the comparison is made, the destination register is automatically up- 
dated. If the direction flag is (CLD was executed), the destination regis- 
ter is incremented; if the direction flag is 1 (STD was executed), it is decre- 
mented. The increments or decrements are by 1 if bytes are compared, by 
2 if words are compared, or by 4 if doublewords are compared. 

SCASB, SCASW, and SCASD are synonyms for the byte, word and dou- 
ble word SCAS instructions that don't require operands. They are simpler 
to code, but provide no type or segment checking. 

SCAS can be preceded by the REPE or REPNE prefix for a block search of 
CX or ECX bytes or words. Refer to the REP instruction for further details. 



SETcc 



Byte set on condition 

386 processors and greater 





< 


D D 


I 


T S Z A P C 


Opcode 


Instruction 




Clocks 


Description 






486 


386 




OF 97 


SETA r/m8 


4/3 


4/5 


Set byte if above (CF=0 and ZF=0) 


OF 93 


SETAE r/m8 


4/3 


4/5 


Set byte if above or equal (CF=0) 


OF 92 


SETB r/m8 


4/3 


4/5 


Set byte if below (CF=1) 


OF 96 


SETBE r/m8 


4/3 


4/5 


Set byte if below or equal (CF=1 or ZF=1) 


OF 92 


SETC r/m8 


4/3 


4/5 


Set if carry (CF=1) 


OF 94 


SETE r/m8 


4/3 


4/5 


Set byte if equal (ZF=1) 


0F9F 


SETG r/m8 


4/3 


4/5 


Set byte if greater (ZF=0 or SF=OF) 


0F9D 


SETGE r/m8 


4/3 


4/5 


Set byte if greater or equal (SF=OF) 


0F9C 


SETL r/m8 


4/3 


4/5 


Set byte if less (SFoOF) 


0F9E 


SETLE r/m8 


4/3 


4/5 


Set byte if less or equal (ZF=1 and SFoOF) 


OF 96 


SETNA r/m8 


4/3 


4/5 


Set byte if not above (CF=1) 


OF 92 


SETNAE r/m8 


4/3 


4/5 


Set byte if not above or equal (CF=1 ) 


OF 93 


SETNB r/m8 


4/3 


4/5 


Set byte if not below (CF=0) 


OF 97 


SETNBE r/m8 


4/3 


4/5 


Set byte if not below or equal (CF=0 and ZF=0) 


OF 93 


SETNC r/m8 


4/3 


4/5 


Set byte if not carry (CF=0) 


OF 95 


SETNE r/m8 


4/3 


4/5 


Set byte if not equal (ZF=0) 


0F9E 


SETNG r/m8 


4/3 


4/5 


Set byte if not greater (ZF=1 or SFoOF) 


0F9C 


SETNGE r/m8 


4/3 


4/5 


Set byte if not greater or equal (SFoOF) 


0F9D 


SETNLr/m8 


4/3 


4/5 


Set byte if not less (SF=OF) 


0F9F 


SETNLE r/m8 


4/3 


4/5 


Set byte if not less or equal (ZF=1 and SFoOF) 


OF 91 


SETNO r/m8 


4/3 


4/5 


Set byte if not overflow (OF=0) 


0F9B 


SETNP r/rti8 


4/3 


4/5 


Set byte if not parity (PF=0) 
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Opcode 


Instruction 




Clocks 


Description 






486 


386 




OF 99 


SETNS r/m8 


4/3 


4/5 


Set byte if not sign (SF=0) 


OF 95 


SETNZ r/m8 


4/3 


4/5 


Set byte if not zero (ZF=0) 


OF 90 


SETOr/m8 


4/3 


4/5 


Set byte if overflow (OF=1) 


0F9A 


SETP r/m8 


4/3 


4/5 


Set byte if parity (PF=1) 


0F9A 


SETPE r/m8 


4/3 


4/5 


Set byte if parity even (PF=1) 


0F9B 


SETPO r/m8 


4/3 


4/5 


Set byte if parity odd (PF=0) 


OF 98 


SETS r/m8 


4/3 


4/5 


Set byte if sign (SF=1) 


OF 94 


SETZ r/m8 


4/3 


4/5 


Set byte if zero (ZF=1) 



SETcc stores a byte containing 1 at the destination specified by the effec- 
tive address or register if the condition is met, or a byte if the condition 
is not met. 



Store global/interrupt descriptor table 
80286 and greater protected mode only 



Opcode Instruction Clocks Description 








486 


386 


286 


■ 


OF 01 /0 


SGDTm 


10 


9 


11 


Store GDTR torn 


OF 01 /1 


SIDTm 


10 


9 


12 


Store IDTR to m 



SGDT/SIDT copies the contents of the descriptor table register to the six 
bytes of memory indicated by the operand. The LIMIT field of the regis- 
ter is assigned to the first word at the effective address. If the operand- 
size attribute is 16 bits, the next three bytes are assigned the BASE field 
of the register, and the fourth byte is written with zero. The last byte is 
undefined. Otherwise, if the operand-size attribute is 32 bits, the next 
four bytes are assigned the 32-bit BASE field of the register. 

SGDT and SIDT are used only in operating system software; they are not 
used in application programs. 



SHLD Double precision shift left 

386 processors and greater 



Opcode Instruction Clocks Description 



r/m16 gets SHL of r/m16 concatenated with r1 6 
r/m32 gets SHL of r/m32 concatenated with r32 
r/m16 gets SHL of r/m16 concatenated with r1 6 
r/m32 gets SHL of r/m32 concatenated with r32 
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486 


386 


0FA4 


SHLD r/m16,r16,imm8 


2/3' 


3/7 


0FA4 


SHLD r/m32,r32,imm8 


2/3 


3/7 


0FA5 


SHLDr/m16,r16,CL 


2/3 


3/7 


0FA5 


SHLD r/m32,r32,CL 


2/3 


3/7 



SHLD shifts the first operand provided by the r/m field to the left as 
many bits as specified by the count operand. The second operand (rl6 or 
r32) provides the bits to shift in from the right (starting with bit 0). The re- 
sult is stored back into the r/m operand. The register remains unaltered. 

The count operand is provided by either an immediate byte or the con- 
tents of the CL register. These operands are taken MODULO 32 to pro- 
vide a number between and 31 by which to shift. Because the bits to 
shift are provided by the specified registers, the operation is useful for 
multiprecision shifts (64 bits or more). The SF, ZF and PF flags are set ac- 
cording to the value of the result. CF is set to the value of the last bit 
shifted out. OF and AF are left undefined. 



SHRD Double precision shift right 

386 processors and greater 



Opcode Instruction Clocks Description 







486 


386 


OF AC 


SHRD r/m16,r16,imm8 


2/3 


3/7 


OF AC 


SHRD r/m32,r32,imm8 


2/3 


3/7 


OF AD 


SHRD r/m16,r16,CL 


3/4 


3/7 


OF AD 


SHRD r/m32,r32,CL 


3/4 


3/7 



r/m 16 gets SHR of r/m1 6 concatenated with r16 
r/m32 gets SHR of r/m32 concatenated with r32 
r/m 16 gets SHR of r/m1 6 concatenated with r16 
r/m32 gets SHR of r/m32 concatenated with r32 



SHRD shifts the first operand provided by the r/m field to the right as 
many bits as specified by the count operand. The second operand (rl6 or 
r32) provides the bits to shift in from the left (starting with bit 31). The re- 
sult is stored back into the r/m operand. The register remains unaltered. 

The count operand is provided by either an immediate byte or the con- 
tents of the CL register. These operands are taken MODULO 32 to pro- 
vide a number between and 31 by which to shift. Because the bits to 
shift are provided by the specified register, the operation is useful for 
multi-precision shifts (64 bits or more). The SF, ZF and PF flags are set ac- 
cording to the value of the result. CF is set to the value of the last bit 
shifted out. OF and AF are left undefined. 



SLDT Store local descriptor table register 

80286 and greater protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00/0 


SLDTr/m16 


486 
2/3 


386 
pm=2/2 


286 

2/3 


Store LDTR to EA word 
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SLDT stores the Local Descriptor Table Register (LDTR) in the two-byte 
register or memory location indicated by the effective address operand. 
This register is a selector that points into the global descriptor table. 

SLDT is used only in operating system software. It is not used in applica- 
tion programs. 



SMSW Store machine status word 

80286 and greater protected mode only 



ODITSZAPC 



Opcode 


Instruction 




Clocks 


Description 


OF 01 /4 


SMSW r/m16 


486 
2/3 


386 286 
2/3,pm=2/2 2/3 


Store machine status word to EA word 



SMSW stores the machine status word (part of CRO) in the two-byte regis- 
ter or memory location indicated by the effective address operand. 



STC Set carry flag 



Opcode 


Instruction 


Clocks 




Description 


F9 


486 
STC 2 


386 286 
2 2 


86 
2 


Set carry flag 



STC sets the carry flag to 1. 

STD Set direction flag 



ODITSZAPC 
1 



Opcode Instruction Clocks Description 



486 386 286 86 
FD ,STD 2 2 2 2 Set direction flag so (E)SI or (E)DI decrement 

STD sets the direction flag to 1, causing all subsequent string operations 
to decrement the index registers, (E)SI and/or (E)DL on which they oper- 
ate. 
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STI Set interrupt enable flag 



ODITSZAPC 

1 



Opcode 


Instruction 




Clocks 




Description 


FB 


STI 


486 
5 


386 286 
3 2 


86 
2 


Set interrupt flag 



STI sets the interrupt flag to 1. The CPU then responds to external inter- 
rupts after executing the next instruction if the next instruction allows the 
interrupt flag to remain enabled. If external interrupts are disabled and 
you code STI, RET (such as at the end of a subroutine), the RET is al- 
lowed to execute before external interrupts are recognized. Also, if exter- 
nal interrupts are disabled and you code STI, CLI, then external inter- 
rupts are not recognized because the CLI instruction clears the interrupt 
flag during its execution. 



STOS Store string data 

STOSB STOSD 386 processors and greater 



STOSD 





D I T 


S 


Z A P C 


Opcode Instruction 




Clocks 




Description 




486 


386 286 


86 




AA STOS m8 
AB ST0Sm16 
AB STOS m32 
AA STOSB 
AB STOSW 
AB STOSD 


5 
5 
5 
5 
5 
5 


4 3 

4 3 

4 

4 3 

4 3 

4 


11 

11 

11 
11 


Store AL in byte ES:[(E)DI] 
Store AX in word ES:[(E)DI] 
Store EAX in dword ES:[(E)DI] 
Store AL in byte ES:[(E)DI] 
Store AX in word ES:[(E)DI] 
Store EAX in dword ES:[(E)DI] 



STOS transfers the contents of the AL, AX, or EAX register to the mem- 
ory byte, word, or doubleword given by the destination register relative 
to the ES segment. The destination register is DI for an address-size attrib- 
ute of 16 bits or EDI for an address-size attribute of 32 bits. 

The destination operand must be addressable from the ES register. A seg- 
ment override is not possible. 

The address of the destination is determined by the contents of the desti- 
nation register, not by the explicit operand of STOS. This operand is used 
only to validate ES segment addressability and to determine the data 
type. Load the correct index value into the destination register before exe- 
cuting STOS. 

After the transfer is made, DI is automatically updated. If the direction 
flag is (CLD was executed), DI is incremented; if the direction flag is 1 
(STD was executed), DI is decremented. DI is incremented or decre- 
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mented by 1 if a byte is stored, by 2 if a word is stored, or by 4 if a dou- 
bleword is stored. 

STOSB, STOSW, and STOSD are synonyms for the byte, word, and dou- 
ble-word STOS instructions, that do not require an operand. They are sim- 
pler to use, but provide no type or segment checking. 

STOS can be preceded by the REP prefix for a block fill of CX or ECX 
bytes, words, or doublewords. Refer to the REP instruction for further de- 
tails. 



STR 



Store task register 

80286 and greater protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00 /1 


STR r/m16 


486 
2/3 


386 
pm=23/27 


286 

2/3 


Load EA word into task register 



The contents of the task register are copied to the two-byte register or 
memory location indicated by the effective address operand. 

STR is used only in operating system software. It is not used in applica- 
tion programs. 



SUB 



Integer Subtraction 



Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




2Cib 
2Diw 


SUB AL,imm8 
SUBAX,imm16 


1 
1 


2 
2 


3 
3 


4 
4 


Subtract immediate byte from AL 
Subtract immediate word from AX 


2D id 


SUB EAX,imm32 


1 


2 






Subtract immediate dword from EAX 


80 15 ib 

81 15 iw 


SUB r/m8,imm8 
SUBr/m16,imm16 


1/3 
1/3 


2/7 
2/7 


3/7 
3/7 


4/17+EA 
4/17+EA 


Subtract immediate byte from r/m byte 
Subtract immediate word from r/m word 


81 /5 id 


SUB r/m32,imm32 


1/3 


2/7 






Subtract immediate dword from r/m dword 


83 15 ib 


SUBr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract sign-extended immediate byte 
from r/m word 


83 /5 ib 


SUB r/m32,imm8 


1/3 


2/7 






Subtract sign-extended immediate byte 
from r/m dword 


28 /r 
29 /r 
29 /r 
2A/r 
2B/r 
2B/r 


SUB r/m8,r8 
SUBr/m16,r16 
SUBr/m32,r32 
SUB r8,r/m8 
SUBr16,r/m32 
SUB r32,r/m32 


1/3 
1/3 
1/3 
1/2 
1/2 
1/2 


2/6 
2/6 
2/6 
2/7 
2/7 
2/7 


2/7 
2/7 

2/7 
2/7 


3/16+EA 
3/16+EA 

3/9+EA 
3/9+EA 


Subtract byte register from r/m byte 
Subtract word register from r/m word 
Subtract dword register from r/m dword 
Subtract EA byte from byte register 
Subtract EA word from word register 
Subtract EA dword from dword register 
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SUB subtracts the second operand (SRC) from the first operand (DEST). 
The first operand is assigned the result of the subtraction, and the flags 
are set accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended to the size of the destination oper- 
and. 



TEST Logical compare 








D 


I T 


S 


Z 


A P C 











* 


* 


? * 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




A8ib 


TEST AL,imm8 


1 


2 


3 


4 


And immediate byte with AL 


A9 iw 


TESTAX,imm16 


1 


2 


3 


4 


And immediate word with AX 


A9 id 


TEST EAX,imm32 


1 


2 






And immediate dword with EAX 


F6 /0 ib 


TEST r/m8,imm8 


1/2 


2/5 


3/6 


5/11+EA 


And immediate byte with r/m byte 


F7 /0 iw 


TESTr/m16,imm16 


1/2 


2/5 


3/6 


5/11+EA 


And immediate word with r/m word 


F7 /0 id 


TEST i7m32,imm32 


1/2 


2/5 






And immediate dword with r/m dword 


84 /r 


TEST r/m8,r8 


1/2 


2/5 


2/6 


3/9+EA 


And byte register with r/m byte 


85 /r 


TESTi7m16,r16 


1/2 


2/5 


2/6 


3/9+EA 


And word register with r/m word 


85 /r 


TEST r/m32,r32 


1/2 


2/5 






And dword register with r/m dword 



TEST computes the bit-wise logical AND of its two operands. Each bit of 
the result is 1 if both of the corresponding bits of the operands are 1; 
otherwise, each bit is 0. The result of the operation is discarded and only 
the flags are modified. 

The optimized form of TEST is TESTFLAG (see Part 3). 



VERR Verify a segment for reading or writing 

VERW 80286 and greater protected mode only 



Opcode Instruction Clocks Description 





486 386 286 


OF 00/4 VERRr/m16 


11/11 pm=1 0/1 1 14/16 Set ZF=1 if segment can be read 


OF 00/5 VERWr/m16 


11/11 pm=15/16 14/16 Set ZF=1 if segment can be written 



The two-byte register or memory operand of VERR and VERW contains 
the value of a selector. VERR and VERW determine whether the segment 
denoted by the selector is reachable from the current privilege level and 
whether the segment is readable (VERR) or writable (VERW). If the seg- 
ment is accessible, the zero flag is set to 1; if the segment is not accessible, 
the zero flag is set to 0. To set ZF, the following conditions must be met: 
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■ The selector must denote a descriptor within the bounds of the table 
(GDT or LDT); the selector must be "defined." 

■ The selector must denote the descriptor of a code or data segment (not 
that of a task state segment, LDT, or a gate). 

■ For VERR, the segment must be readable. For VERW, the segment 
must be a writable data segment. 

■ If the code segment is readable and conforming, the descriptor privi- 
lege level (DPL) can be any value for VERR. Otherwise, the DPL must 
be greater than or equal to (have less or the same privilege as) both the 
current privilege level and the selector's RPL. 

The validation performed is the same as if the segment were loaded into 
DS, ES, FS, or GS, and the indicated access (read or write) were per- 
formed. The zero flag receives the result of the validation. The selector's 
value cannot result in a protection exception, enabling the software to an- 
ticipate possible segment access problems, 

WAIT Wait until BUSY# pin is inactive (HIGH) 



Opcode 


Instruction 




Clocks 




Description 


9B 


WAIT 


486 
1-3 


386 286 
6 3 


86 
4+5n 


Wait until BUSY pin is inactive (HIGH) 



WAIT suspends execution of CPU instructions until the BUSY# pin is in- 
active (high). The BUSY# pin is driven by the 80x87 numeric processor ex- 
tension. 



WBINVD Write-back and Invalidate cache 

i486 processors and greater 



Opcode Instruction Clock Description 



486 
OF 09 WBINVD 5 Write-back and invalidate entire cache 

The internal cache is flushed, and a special-function bus cycle is issued 
which indicates that the external cache should write-back its contents to 
main memory. Another special-function bus cycle follows, directing the 
external cache to flush itself. 

Note: This instruction is implementation-dependent; its function might 
be implemented differently on future Intel processors. It is the responsi- 
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bility of the hardware to respond to the external cache write-back and 
flush indications. 



WRMSR Write to Model Specific Register 

Pentium processors and greater 



Opcode 


Instruction 


Clocks 


Description 


OF 30 


WRMSR 


Pentium 
30-45 


Write the value in EDX:EAX to Model Specific 
Register indicated by ECX. 



The value in ECX specifies one of the 64-bit Model Specific Registers of 
the Pentium processor. The contents of EDX:EAX is copied into that 
Model Specific Register. The high-order 32 bits are copied from EDX and 
the low-order 32 bits arecopied from EAX. 

The following values are used to select model specific registers on the 
Pentium processor: 

Value (in Hex) Register Name Description 

OOh Machine Check Address Stores address of cycle causing 

the exception. 

01 h Machine Check Type Stores cycle type of cycle causing 

the exception. 

Other values used to preform cache, TLB and BTB testing and perform- 
ance monitoring, are availible under a non-disclosure agreement from In- 
tel. 

Protected mode exceptions: #GP(0) if either the current privilege level is 
riot or the value in ECX does not specify a Model-Specific Register that 
is implemented in the Pentium processor. 

Real mode exceptions: #GP if the value in ECX does not specify a Model- 
Specific Register that is implemented in the Pentium processor. 

, Virtual 8086 mode exceptions: #GP(0) if instruction execution is at- 
tempted. 

Notes: This instruction must be executed at privilege level or in real-ad- 
dress mode; otherwise a protection exception will be generated. 

Always set undefined or reserved bits to the value previously read. 

WRMSR is used to write the content of Model-Specific Registers that con- 
trol functions for testability, execution tracing, performance monitoring 
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and machine check errors. Refer to the Pentium Processor Data Book for 
more information or contact Intel. 

The values 3h, OFh, and values above 13h are reserved. Do not execute 
WRMSR with reserved values in ECX. 



XADD 



Exchange and add 

i486 processors and greater 



Opcode Instruction 



Clock Description 



OF CO/r XADD r/m8,r8 
OF C1/r XADD r/m16,r168 
OF C1/r XADD r/m32,r32 



486 
3/4 
3/4 
3/4 



Exchange byte register and r/m byte; load sum into r/m byte. 
Exchange word register and r/m word; load sum into r/m word. 
Exchange dword register and r/m dword; load sum into r/m dword. 



The XADD instruction loads DEST into SRC, and then loads the sum of 
DEST and the original value of SRC into DEST. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable seg- 
ment; #GP(0) for an illegal memory operand effective address in the CS, 
DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS seg- 
ment; #PF (fault code) for a page fault; #NM if either EM or TS in CRO is 
set; #AC for an unaligned memory reference if the current privilege level 
is 3. 

Real address mode exceptions: interrupt 13 if any part of the operand 
would lie outside the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: same exception as in real-address mode; 
same #PF and #AC exceptions as in protected mode. 



XCHG 



Exchange memory/register with register 



Opcode 


Instruction 




Clocks 








486 


386 


286 


86 /r 


XCHG r/m8,r8 


3/5 


3/5 


3/5 


86 /r 


XCHG r8,r/m8 


3/5 


3/5 


3/5 


87 /r 


XCHGr/m16,r16 


3/5 


3/5 


3/5 


87 /r 


XCHG M6,r/m16 


3/5 


3/5 


3/5 


87 /r 


XCHG r/m32,r32 


3/5 


3/5 




87 /r 


XCHG r32,r/m32 


3/5 


3/5 




90+ r 


XCHGAX,r16 


3 


3 


3 



Description 



4/17+EA Exchange byte register with EA byte 
4/1 7+EA Exchange byte with EA byte register 
4/17+EA Exchange word register with EA word 
4/17+EA Exchange word register with EA word 
Exchange dword register with EA dword 
Exchange dword register with EA dword 
3 Exchange word register with AX 
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Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 


90+ r 


XCHGM6.AX 


3 


3 


3 


3 


90+ r 


XCHG EAX,r32 


3 


3 






90+ r 


XCHG r32,EAX 


3 


3 







Exchange word register with AX 
Exchange dword register with EAX 
Exchange dword register with EAX 



XCHG exchanges two operands. The operands can be in either order. If a 
memory operand is involved, BUS LOCK is asserted for the duration of 
the exchange, regardless of the presence or absence of the LOCK prefix or 
of the value of the IOPL. 



XLAT 
XLATB 



Table look-up translation 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 


D7 


XLAT m8 


4 


5 


5 


11 


D7 


XLATB 


4 


5 


5 


11 



Set AL to memory byte DS:[(E)BX + unsigned AL] 
Set ALto memory byte DS:[(E)BX + unsigned AL] 



XLAT changes the AL register from the table index to the table entry. AL 
should be the unsigned index into a table addressed by DS:BX (for an ad- 
dress-size attribute of 16 bits) or DS:EBX (for an address-size attribute of 
32 bits). 

The operand to XLAT allows for the possibility of a segment override. 
XLAT uses the contents of BX even if they differ from the offset of the op- 
erand. The offset of the operand should have been moved into BX/EBX 
with a previous instruction. 

The no-operand form, XLATB, can be used if the BX/EBX table will al- 
ways reside in the DS segment. 



XOR 



Logical exclusive OR 








D 


I 


T 


S 


z 


A P C 













* 


* 


? * 


Opcode 


Instruction 




Clocks 








Description 






486 


386 


286 


86 






34 ib 


XOR AL,imm8 


1 


2 


3 


4 




Exclusive-OR immediate byte to AL 


35 iw 


XOR AX,imm16 


1 


2 


3 


4 




Exclusive-OR immediate word to AX 


35 id 


XOR EAX,imm32 


1 


2 








Exclusive-OR immediate dword to EAX 


80 /6 ib 


XOR r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Exclusive-OR immediate byte to r/m byte 


81 /6 iw 


XORr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


Exclusive-OR immediate word to r/m word 


81 /6 id 


XOR r/m32,imm32 


1/3 


2/7 








Exclusive-OR immediate dword to r/m 
dword 


83 /6 ib 


XORr/m16,imm8 


1/3 


2/7 








XOR sign-extended immediate byte to 
r/m word 
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Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




83 /6 ib 


XOR r/m32,imm8 


1/3 


2/7 






XOR sign-extended immediate byte to 
r/m dword 


30 /r 


XOR r/m,r8 


1/3 


2/6 


2/7 


3/16+EA 


Exclusive-OR byte register to r/m byte 


31 /r 


XOR r/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


Exclusive-OR word register into r/m word 


31 /r 


XOR r/m32,r32 


1/3 


2/6 






Exclusive-OR dword register to r/m dword 


32 /r 


XOR r8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Exclusive-OR r/m byte to byte register 


33 /r 


XORr16,r/m16 


1/2 


2/7 


2/7 


3/9+EA 


Exclusive-OR r/m word to word register 


33 /r 


XOR r32,r/m32 


1/2 


2/7 






Exclusive-OR to r/m dword to dword 
register 



XOR computes the exclusive OR of the two operands. Each bit of the re- 
sult is 1 if the corresponding bits of the operands are different; each bit is 
if the corresponding bits are the same. The answer replaces the first op- 
erand. 

The optimized form of XOR is FLIPFLAG (see Part 3). 
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PART 



Coprocessor instructions 
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This part lists the 80x87 instructions in alphabetical order. 

There is one entry for each combination of operand types that can be 
coded with the mnemonic. The following table explains the operand iden- 
tifiers used in this section: 

Identifier Explanation 

ST Stack top; the register currently at the top of the stack. 

ST(1) A register in the stack i(0<i<7) stack elements from the 

top. ST(1) is the next-on-stack register, ST(2) is below 
ST(1), etc. 

m32real A short real (32 bits) number in memory. 

m64real A long real (64 bits) number in memory. 

m80real A temporary real (80 bits) number in memory. 

m80dec A packed decimal integer (18 digits, 10 bytes) in 

memory. 

ml6int A word binary integer (16 bits) in memory. 

m32int A short binary integer (32 bits) in memory. 

m64int A long binary integer (64 bits) in memory. 

mxxbyte A memory area xx bytes long. 



Here is a summary of the possible exceptions each instruction can cause: 

■ IS = invalid operand due to stack overflow/ underflow 

■ I = invalid operand due to other cause 

■ D = denormal operand 

■ Z = zero-divide 

■ O = Overflow 

■ U = Underflow 

■ P = Inexact result (precision) 
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F2XM1 Compute 2 X -1 

Exceptions: P, U, D, I, IS 
F2XM1 (no operands) 

Operands Execution clocks 



D9F0 



87 



F2XM1 



287 
211-476 



387 
211-476 



486 
242(140-279) 



586 
13-57 



FABS 



Absolute value 



Operands 




Exceptions: IS 
FABS (no operands) 

Execution clocks 




No operands 


8Z 
10-17 


287 387 486 
10-17 22 3 2 


FABS 


FADD 




Add real 




Operands 


Exceptions: I, D, O, U, P, IS 
FADD destination, source 

Execution clocks Code bytes 


Example 


ST,ST(i) 
ST(i),ST 
short real 
long real 


87 287 387 486 
70-100 70-100 23-34 10(8-20) 2 

90-120+EA 90-120 24-32 10(8-20) 2-4 
95-125+EA 95-125 29-37 10(8-20) 2-4 


FADD ST,ST(4) 
FADD ST(2), ST 
FADD AIR TEMP[SI] 
FADD [BXJ.MEAN 






Add real and pop 




FADDP 





Exceptions: l,D,0, U,P,IS 
FADDP destination, source 



Operands 




Execution clocks 




Code bytes 


Example 


ST(i),ST 


87 
75-105 


287 387 
75-105 23-34 


486 
10(8-20) 


2 


FADDP ST(2),ST 
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FBLD 



Operands 



Packed decimal (BCD) load 



Exceptions: I 
FBLD source 

Execution clocks 



Code bytes Example 



87 287 387 486 

Packed decimal 290-310 290-310 5 75(70-103) 2-4 



FBLDYTD SALES 



FBSTP 



Packed decimal (BCD) store and pop 



Operands 


Exceptions: I 
FBSTP destination 

Execution clocks 




Code bytes 


Example 


Packed decimal 


87 287 387 
520-540+EA 520-540+EA 512-534 


486 
175(172-176) 


2-4 


FBSTP 
[BX].FORECAST 


FCHS 


Change sign 








Operands 


Exceptions: I 

FCHS (no operands) 

Execution clocks 


Code bytes 


Example 




No operands 


87 287 387 486 
10-17 10-17 24-25 6 


2 


FCHS 






Clear exceptions 








FCLEX 
FNCLEX 













Operands 



Exceptions: None 
FCLEX/FNCLEX (no operands) 

Execution clocks Code bytes Example 



87 



287 



387 



486 



No operands 2-8 2-8 11 



FNCLEX 
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FCOM 



Compare real 



Exceptions: I, D 
FCOM //source 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 
short real 
long real 


8Z 

40-50 
60-70+EA 
65-75+EA 


287 387 
40-50 24 
60-70 26 
65-75 31 


486 
4 
4 
4 


2-4 
2-4 


FCOM ST(1) 

FCOM [BP].UPPER LIMIT 

FCOM WAVELENGTH 



FCOMP 



Compare real and pop 



Exceptions: I, D 
FCOMP //source 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 
short real 
long real 


8Z 

42-52 
63-73+EA 
67-77+EA 


287 387 
45-52 26 
63-73 26 
67-77 31 


486 
4 
4 
4 


2 

2-4 

2-4 


FCOMP ST(2) 

FCOMP [BP+2J.N READINGS 

FCOMP DENSITY 



FCOMPP 



Operands 



Compare real and pop twice 



Exceptions: I, D 
FCOMPP (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



No operands 45-55 45-55 



387 
26 



486 



FCOMPP 



FCOS 



Cosine of ST(0) 
80387 and greater 



Exceptions: IS, I, D, U, P 
FCOS 



Operands 




Execution clocks 




Code bytes Example 


No operands 


87 


287 387 

123-772* 


486 
241(193-279) 


2 FCOS 



'These timings hold for operands in the range /x/ /4. For operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 
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FDECSTP 



Operands 



Decrement stack pointer 



Exceptions: None 
FDECSTP (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



No operands 6-12 6-12 



387 
22 



486 



FDECSTP 



FDISI 
FNDISI 



FDIV 



Disable interrupts 
8087 only 



Exceptions: None 
FDISI (no operands) 



Operands 


Execution clocks: 
Typical Range 


Operand word 
transfers 


Code 
bytes 


Example 


No operands 


5 2-8 





2 


FDISI 



Divide real 



Exceptions: l,D,Z, O, U,P 

FDIV //source /destination, source 



Operands 




Execution clocks 




Code bytes 


Example 




8Z 


287 


387 


486 






//ST(i),ST 


193-203 


193-203 


88-91 


73 


2 


FDIV 


short real 


215-225 


215-225 


89 


73 


2-4 


FDIV DISTANCE 


long real 


220-230 


220-230 


94 


73 


2-4 


FDIV ARC[DI] 


//ST,ST(i) 








73 






FDIVP 


Divide real and 


pop 







Exceptions: I, D,Z,0,U,P 
FDIVP destination, source 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i),ST 


87 
197-207 


287 387 
198-209 88-91 


486 
73 


2 


FDIVP ST(4),ST 
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FDIVR 



Divide real reversed 



Exceptions: I, D, Z, O, U, P 

FDIVR //source /destination, source 



Operands 



Execution clocks 



Code bytes Example 



87 287 387 486 

//ST,ST(i)/ 194-204 198-208 88-91 73 

ST(i),ST 73 

short real 216-226+EA 215-225 89 73 

long real 221-231+EA 220-230 94 73 



2-4 
2-4 



FDIVR ST(2),ST 

FDIVR [BX].PULSE_RATE 
FDIVR RECORDER.FREQUENCY 



FDIVRP 



Operands 



Divide real reversed and pop 



Exceptions: I, D, Z, O, U, P 
FDIVRP destination, source 

Execution clocks Code bytes 



Example 



ST(i),ST 


87 287 387 486 
198-208 198-208 88-91 73 


2 


FDIVRP ST(1),ST 


FENI 
FNENI 


Enable interrupts 
8087 only 






Operands 


Exceptions: None 
FENI (no operands) 

Execution clock Code bytes Example 




(no operands) 


87 

5(2-8) 2 FNENI 




FFREE 


Free register 






Operands 


Exceptions: None 
FFREE destination 

Execution clocks 


Code bytes 


Example 


ST(i) 


87 287 387 486 
9-16 9-16 18 3 


2 


FFREE ST(1) 



PART 5, Coprocessor instructions 



139 



FIADD integer add 

Exceptions: I, D, O, P 
FIADD source 

Operands Execution clocks 



Code Example 
bytes 



87 


287 


387 


486 




word integer 102-137+EA 


102-137 


71-85 


22.5(19-32) 2-4 


FIADD DISTANCE TRAVELLED 


short integer 108-143+EA 


108-143 


57-72 


24(20-35) 2-4 


FIADD PULSE_COUNT [SI] 



FICOM 



Operands 



Integer compare 



Exceptions: I, D 
FICOM source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 






word integer 


72-86+EA 


72-86 


71-75 


18(16-20) 


2-4 


FICOM TOOL.N PASSES 


short integer 


78-91 +EA 


78-91 


56-63 


16.5(15-17.) 


2-4 


FICOM [BP+4].PARM_COUNT 



FICOMP 



Operands 



Integer compare and pop 



Exceptions: I, D 
FICOMP source 

Execution clocks 



Code bytes Example 



87 287 387 486 

word integer 74-88+EA 74-88 71-75 18(16-20) 2-4 
short integer 80-93+EA 80-93 56-63 16.5(15-17) 2-4 



FICOMP [BP].UMIT [SI] 
FICOMP N SAMPLES 



FIDIV 



Operands 



Integer divide 



Exceptions: I, D,Z.O,U, P 
FiDIV source 

Execution clocks 



Code Example 
bytes 





87 


287 


387 486 






word integer 


224-238+EA 


224-238 


136-140 73 


2-4 


FIDIV SURVEY.OBSERVATIONS 


short integer 


230-243+EA 


230-243 


120-127 73 


2-4 


FIDIV RELATIVE_ANGLE [Dl] 
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FIDIVR 



Operands 



Integer divide reversed 



Exceptions: l,D,Z, O, U, P 
FIDIVR source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 






word integer 


225-239+EA 


224-238 


135-141 


73 


2-4 


FIDIVR [BPJ.X COORD 


short integer 


231-245+EA 


230-243 


121-128 


73 


2-4 


FIDIVR FREQUENCY 



FILD 



Integer load 



Exceptions: I 
FILD source 



Operands 




Execution clocks 




Code bytes 


Example 


word integer 
short integer 
long integer 


87 

46-54+EA 
52-60+EA 
60-68+EA 


287 387 
46-54 61-65 
52-60 45-52 
60-68 56-67 


486 

11.5(9-12) 
14.5(13-16) 
16.8(10-18) 


2-4 
2-4 
2-4 


FILD [BX].SEQUENCE 
FILD STANDOFF [Dl] 
FILD RESPONSE.COUNT 



FIMUL 



Operands 



Integer multiply 



Exceptions: I, D, O, P 
FIMUL source 
Execution clocks 



Code bytes Example 





87 287 387 486 




word integer 


124-138+EA 124-138 76-87 8 2-4 


FIMUL BEARING 


short integer 


130-144+EA 130-144 61-82 8 2-4 


FIMUL POSITION. Z_AXIS 


FINCSTP 


Increment stack pointer 
Exceptions: None 
FINCSTP (no operands) 




Operands 


Execution clocks Code bytes 


Example 




87 287 387 486 




No operands 


6-12 6-12 21 3 2 


FINCSTP 
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FINIT 

FNINIT 



Operands 



Initialize processor 



Exceptions: None 
FINIT/FNINIT (no operands) 

Execution clocks Code bytes 



Example 



No operands 


87 
2-8 


287 387 486 

2-8 33 17 2 




FINIT 


FIST 




Integer store 






Operands 


Exceptions: I, P 
FIST destination 

Execution clocks 


Code 
bytes 


Example 


word integer 
short integer 


87 287 387 486 
80-90+EA 80-90 82-95 33.4(29-34) 
82-92+EA 82-92 79-93 32.4(28-34) 


2-4 
2-4 


FIST OBS.COUNT [SI] 

FIST [BP;].FACTORED_PULSES 



FISTP 



Operands 



Integer store and pop 



Exceptions: LP 
FISTP destination 

Execution clocks 



Code bytes Example 



87 287 387 486 

word integer 82-92+EA 82-92 82-95 33.4(29-34) 2-4 

short integer 84-94+EA 84-94 79-93 33.4(29-34) 2-4 

long integer 94-105+EA 94-1.05 80-97 33.4(29-34) 2-4 



FISTP [BX], 
ALPHA_COUNT [SI] 
FISTP CORRECTEDJIME 
FISTP PANEL N READINGS 



FISUB 



Operands 



Integer subtract 



Exceptions: I, D, O, P 
FISUB source 

Execution clocks 



Code 

bytes Example 





87 


287 


387 


486 




word integer 


102-137+EA 


102-137 


71-83 


22.5(19-32) 2-4 


FISUB BASE FREQUENCY 


short integer 


108-143+EA 


108-143 


57-82 


24(20-35) 2-4 


FISUB TRAIN_SIZE [Dl] 
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FISUBR 



Operands 



Integer subtract reversed 



Exceptions: I, D, O, P 
FISUBR source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 






word integer 


103-139+EA 


102-137 


72-84 


22.5(19-32) 


2-4 


FISUBR FLOOR [BX][SI] 


short integer 


109-144+EA 


108-143 


58-83 


24(20-35) 


2-4 


FISUBR BALANCE 



FLD 




Load real 






Operands 


Exceptions: I, D 
FLD source 

Execution clocks 


Code bytes 


Example 


ST(i) 

short real 
long real 
Temp real 


87 

17-22 

38-56+EA 

40-60+EA 

53-65+EA 


287 387 486 

17-22 14 4 

, 38-56 20 3 

t 40-60 25 3 

, 53-65 44 6 


2 

2-4 
2-4 
2-4 


FLD ST(0) 

FLD READING [SI].PRESSURE 
FLD [BP].TEMPERATURE 
FLD SAVEREADING 






Load control word 




FLDCW 






Exceptions: None 
FLDCW source 







Operands 




Execution clocks 




Code bytes 


Example 


2 bytes 


87 
7-14+EA 


287 387 
7-14 19 


486 
4 


2-4 


FLDCW CONTROL_WORD 



FLDENV 



Load environment 



Exceptions: None 
FLDENV source 



Operands 




Execution clocks 




Code bytes Example 


14 bytes 


87 
35-45+EA 


287 387 
35-45 71 


486 

44 real or virtual 

34 protected 


2-4 FLDENV [BP+6] 
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FLDLG2 




Load Iogio2 








Operands 


Exceptions: I 

FLDLG2 (no operands) 

Execution clocks 


Code bytes 


Example 


No operands 


87 
18-24 


287 387 
18-24 41 


486 
8 


2 


FLDLG2 






Load log e 2 








FLDLN2 





Operands 



Exceptions: I 

FLDLN2 (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



No operands 17-23 17-23 



387 486 
41 8 



FLDLN2 



FLDL2E 



Operands 



Load log2e 



Exceptions: I 

FLDL2E (no operands) 

Execution clocks Code bytes 



Example 



No operands 


87 287 387 
15-21 15-21 40 






FLDL2T 


Load Iog2l0 



FLDL2E 



Exceptions: I 

FLDL2T (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


87 
16-22 


287 387 
16-22 40 


486 
8 


2 


FLDL2T 
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FLDPI 



Load P (pi) 



Operands 



Exceptions: I 

FLDPI (no operands) 

Execution clocks Code bytes 



Example 



No operands 



87 
16-22 



287 
16-22 



387 
40 



486 



FLDPI 



FLDZ 



Operands 



Load +0.0 



Exceptions: I 

FLDZ (no operands) 

Execution clocks 



Code bytes Example 



No operands 



87 

11-17 



287 
11-17 



387 
20 



FLDZ 



FLD1 



FMUL 



Operands 



Load +1.0 



Exceptions: I 

FLD1 (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


87 
15-21 


287 387 
15-21 24 


486 

4 


2 


FLD1 



Multiply real 



Exceptions: I, D, O, U, P 

FMUL // source /destination,source 









Code 




Execution clocks 




bytes 


Example 


287 


387 


486 






90-145 


29-57 


16 


2 


FMUL ST,ST(3) 


90-145 


29-57 


16 


2 


FMUL ST,ST(3) 


110-125 


27-35 


11 


2-4 


FMUL SPEED FACTOR 


112-168 


32-57 




2-4 


FMUL [BPJ.HEIGHT 


112-168 


32-57 


14 


2-4 


FMUL [BPJ.HEIGHT 



87 
//ST(i), ST/ST, 90-105,ST(1)* 90-105 
//ST(i),ST/ST, ST,ST(1) 130-145 

short real 110-125+EA 

long real* 112-126+EA 

long real 154-168+EA 



*Occurs when one or both operands is "short"— it has 40 trailing zeros in its fraction (for example, it was loaded from 
a short-real memory operand). 
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FMULP 



Operands 



Multiply real and pop 



Exceptions: I, D, O, U, P 
FMULP destination,source 

Execution clocks Code bytes 



Example 





87 


287 


387 


486 






ST(i),Sr 


94-108 


198-208 


29-57 




2 


FMULP ST(1),ST 


ST(i),ST 


134-148 


198-208 


29-57 


16 


2 


FMULP ST(1),ST 



'Occurs when one or both operands is "short"— it has 40 trailing zeros in its fraction (for example, it was loaded from 
a short-real memory operand). 



FNOP 



No operation 



Exceptions: None 
FNOP (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


87 
10-16 


287 387 
10-16 12 


486 
3 


2 


FNOP 



FPATAN 



Operands 



Partial arctangent 



Exceptions: U, P (operands not checked) 
FPATAN (no operands) 

Execution clocks Code bytes Example 



87 287 387 486 

No operands 250-800 250-800 314-487 5(2-17) 2 



FPATAN 



FPREM 



Operands 



Partial remainder 



Exceptions: I, D, U 
FPREM (no operands) 

Execution clocks Code bytes 



Example 



No operands 



87 
15-190 



287 
15-190 



387 486 

74-155 2(2-8) 



FPREM 
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FPREM1 



Operands 



Partial remainder 
80387 and greater 



Exceptions: I, D, U 
FPREM (no operands) 

Execution clocks 



Code bytes Example 



87 287 387 486 

No operands 95-185 94.5(72-167) 



FPREM1 



FPTAN 



Partial tangent 



Exceptions: I, P (operands not checked) 
FPTAN (no operands) 



Operands 




Execution clocks 


Code bytes 


Example 


No operands 


87 
30-540 


287 387 
30-540 191-573 


486 
244(200-273) 2 


FPTAN 



FRNDINT 



Round to integer 



Exceptions: I, P 
FRNDINT (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


8Z 
16-50 


287 .387 
16-50 66-80 


486 
29.1(21-30) 


2 


FRNDINT 



FRSTOR 



Operands 



Restore saved state 



Exceptions: None 
FRSTOR source 

Execution clocks 



Code bytes Example 



87 287 387 

94 bytes 197-207+EA 205-215 308 



486 

131 real or virtual 

120 protected 



2-4 



FRSTOR [BP] 



Note: The 80287 execution clock count for this instruction is not meaningful in determining overall instruction execu- 
tion time. For typical frequency ratios of the 80286 and 80287 clocks, 80287 execution occurs in parallel with the op- 
erand transfers. The operand transfers determine the overall execution time of the instructions. For 80286:80287 
clock frequency ratios of 4:8, 1 :1 , and 8:5, the overall execution clock count for this instruction is estimated at 490, 
302, and 227 80287 clocks, respectively. 
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FSAVE 
FNSAVE 



Operands 



Save state 



Exceptions: None 
FSAVE/FNSAVE destination 



Execution clocks 



Code bytes Example 



94 bytes 



197-207+EA 



287 
205-215 



387 
375-376 



486 



2-4 



FSAVE [BP] 



Note: The 80287 execution clock count for this instruction is not meaningful in determining overall instruction execu- 
tion time. For typical frequency ratios of the 80286 and 80287 clocks, 80287 execution occurs in parallel with the op- 
erand transfers. The operand transfers determine the overall execution time of the instruction. For 80286:80287 
clock frequency ratios of 4:8, 1 :1 , and 8:5, the overall execution clock count for this instruction is estimated at 376, 
233, and 1 74 80287 clocks, respectively. 



FSCALE 



Operands 



Scale 



Exceptions: I, O, U 
FSCALE (no operands) 

Execution clocks 



Code bytes Example 



No operands 



87 
32-38 



287 
32-38 



387 486 
67-86 31(30-32) 



FSCALE 



FSETPM 



Operands 



Set protected mode 



Exceptions: None 
FSETPM (no operands) 

Execution clock Code bytes Example 



287 
No operands 2-8 



FSETPM 



FSIN 



Operands 



Sine of ST(O) 
80387 and greater 



Exceptions: IS, I, D, U, P 
FSIN 



Execution clocks 



Code bytes Example 



No operands 



387 
122-771* 



486 
241(193-279) 



FSIN 



These timings hold for operands in the range /x/ /4.f or operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 
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FSINCOS 



Sine and cosine of ST(0) 
80387 and greater 



Exceptions: IS, I, D, U, P 
FSINCOS 



Operands 



Execution clocks 



Code bytes Example 



387 
No operands 194-809* 



486 

291 (243-329) 



FSINCOS 



*These timings hold for operands in the range /*/ /4. For operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 



FSQRT 



Operands 



Square root 



Exceptions: I, D, P 
FSQRT (no operands) 

Execution clocks 



Code bytes Example 



87 287 387 486 

No operands 180-186 180-186 122-129 85.5(83-87) 2 



FSQRT 



FST 



Store real 



Exceptions: I, O, U, P 
FST destination 



Operands 




Execution clocks 


Code bytes 


Example 


ST(i) 

short real 
long real 


87 287 
15-22 15-22 
84-90+EA 84-90 
96-104+EA96-104 


387 486 
11 3 

44 7 

45 8 


2 

2-4 

2-4 


FST ST(3) 

FST CORRELATION [Dl] 

FST MEAN_READING 






Store control word 






FSTCW 
FNSTCW 

Operands 




Exceptions: None 
FSTCW destination 

Execution clocks 


Code bytes 


Example 


2 bytes 


87 287 
12-18+EA 12-18 


387 486 

15 


2-4 


FSTCW SAVE_CONTROL 
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FSTENV 
FNSTENV 

Operands 




Store environment 






Exceptions: None 
FSTENV destination 

Execution clocks 


Code bytes 


Example 


14 bytes 


87 287 387 -486 
40-50+EA 40-50 103-104 


2-4 


FSTENV [BP] 



FSTP 



Operands 



Store real and pop 



Exceptions: I, O, U; P 
FSTP destination 

Execution clocks 



Code bytes Example 



87 287 

ST(i) 17-24 17-24 

short real 86-92+EA 86-92 

long real 98-106+EA 98-106 

Temp real 52-58+EA 52-58 



387 486 

12 3 2 

44 7 2-4 

45 8 2-4 
53 6 . 2-4 



FSTP ST(2) 

FSTP [BX]. ADJUSTED_RPM 
FSTP TOTAL_DOSAGE 
FSTP REG SAVE [SI] 



FSTSW 
FNSTSW 



Store status word 



Exceptions: None 
FSTSW/FNSTSW destination 



Operands Execution clocks 


Code bytes 


Example 


87 287 387 486 
2 bytes 12-18+EA 12-18 15 3 


2-4 


FSTSW SAVE_STATUS 




to AX 




FSTSW AX Store status word • 




FNSTSW AX 







Exceptions: None 
FSTSW destination 



Operands 




Execution clocks 




Code bytes 


Example 


AX 


87 


287 387 
10-16 13 


486 
3 


2 


FSTSW AX 
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FSUB 



Subtract real 



Exceptions: I, D, O, U, P 

FSUB / / source / destination,source 



Operands 


Execution clocks 


Code bytes 


Example 


//ST,ST/(i)/ 
ST(i),ST 
short real 
long real 


87 287 387 
70-100 70-100 26-37 

90-120+EA 90-120 24-32 
95-125+EA 95-125 28-36 


486 
7(5-17) 2 

7(5-17) 2-4 
7(5-17) 2-4 


FSUB ST,ST(2) 

FSUB BASE VALUE 
FSUB COORDINATE.X 




Subtract real and pop 




FSUBP 




Operands 


Exceptions: I, D, O, U, P 
FSUBP destination, source 

Execution clocks Code bytes 


Example 


ST(i),ST 


87 287 387 
75-105 75-105 26-37 


486 
7(5-17) 2 


FSUBP ST(2),ST 




Subtract real reversed 




FSUBR 





Operands 



Exceptions: I, D, O, U, P 

FSUBR //source /destination, source 



Operands 




Execution clocks 


Code bytes 


Example 


//ST,ST(i)/ 
ST(i),ST 
short real 
long real 


87 
70-100 

90-120+EA 
95-125+EA 


287 387 
70-100 26-37 

90-120 25-33 
95-125 29-37 


486 
7(5-17) 2 

7(5-17) 2-4 
7(5-17) 2-4 


FSUBR ST,ST(1) 

FSUBR VECTOR [SI] 
FSUBR [BXJ.INDEX 




Subtract real reversed and po 




FSUBRP 


P 



Exceptions: I, D, O, U, P 
FSUBRP destination, source 



Execution clocks 



Code bytes Example 



ST(i),ST 



75-105 



287 
75-105 



387 486 
26-37 7(5-17) 2 



FSUBRP ST(1),ST 



PART 5, Coprocessor instructions 



151 



FTST 



Operands 



Test stack top against +0.0 



Exceptions: I, D 
FTST (no operands) 

Execution clocks 



Code bytes Example 



87 
No operands 38-48 



287 
38-48 



387 
28 



486 

4 



FTST 



FUCOM 



Operands 



Unordered compare 
80387 and greater 



Exceptions: IS, I, D 
Execution clocks Code bytes 



Example 



//ST(i) 



387 
24 



486 
4 



FUCOM ST(1) 



FUCOMP 



Unordered compare 
80387 and greater 





Exceptions: IS, I, D 




Operands 


Execution clocks Code bytes 


Example 




387 486 




//ST(i) 


26 4 2 


FUCOMP ST(2) 



FUCOMPP 



Operands 



Unordered compare 
80387 and greater 



Exceptions: IS, I, D 
Execution clocks Code bytes Example 



387 
No operands 26 



FUCOMPP 



FWAIT 



Wait 



Exceptions: None (CPU instruction) 
FWAIT (no operands) 
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Operands Execution clocks Code bytes Example 

387 486 

No operands 3+5/f 1-3 1 FWAIT 

*n = number of time CPU examines BUSY line before 80287 completes execution of previous instruction. 



FXAM Examine stack top 



Exceptions: None 
FXAM (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


87 
12-23 


287 387 
12-23 30-38 


486 
8 


2 


FXAM 



FXCH Exchange registers 



Exceptions: I 

FXCH //destination 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 


8Z 
10-15 


287 387 
10-15 18 


486 

4 


2 


FXCH ST(2) 



FXTRACT Extract exponent and significant 



Exceptions: I 

FXTRACT (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 : ~ 

No operands 27-55 27-55 70-76 19(16-20) 2 FXTRACT 



FYL2X Y * log 2 X 



Exceptions: P (operands not checked) 
FYL2X (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 

No operands 900-1100 900-1100 120-538 311(196-329) 2 FYL2X 
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FYL2XP1 Y*log2(X+l) 

Exceptions: P (operands not checked) 
FYL2XP1 (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 

No operands 700-1000 700-1000 257-547 313(171-326) 2 FYL2XP1 



F2XM1 



Operands 



2 X -1 



Exceptions: U, P (operands not checked) 
F2XM1 (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



387 



486 



No operands 310-630 310-630 211-476 242(140-279) 



F2XM1 
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